EUVD-2026-91708
GHSA-wm39-rhjr-c7cr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious page
-
DeliveryServe crafted HTML triggering compositing path
-
ExploitTrigger integer overflow (CWE-190)
-
ExecutionRead leaked cross-origin memory
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use an affected Google Chrome version (any build prior to 154.0.8037.97) and to actively load attacker-controlled web content - the required user interaction (UI:R) is navigation to a crafted HTML page, which is the primary limiting factor. No authentication or special configuration is required (PR:N); the bug lies in the default Compositing code path, so no non-default settings are needed. The practical limit on impact is that the flaw only leaks cross-origin data (C:L, no integrity or availability impact) and does not grant code execution, and it is not automatable (SSVC Automatable: no), making opportunistic mass exploitation impractical. |
| Impact | This is a moderate, not urgent, priority. The CVSS 3.1 base score is 4.3 (Medium), driven by network vector (AV:N) and low complexity (AC:L) with no privileges required (PR:N), but tempered by required user interaction (UI:R), unchanged scope (S:U), and a limited impact profile of low confidentiality only (C:L/I:N/A:N) - consistent with a cross-origin data leak rather than code execution. All real-world exploitation signals point low: EPSS is 0.18% (6th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no KEV listing and no identified public exploit. These signals are mutually consistent - a genuinely low-likelihood, medium-impact information disclosure bug. Note that Google/Chromium rates the security severity 'High' internally, which contrasts with the NVD CVSS of 4.3 (Medium); Chromium's severity reflects the sensitivity of a same-origin-policy bypass rather than CVSS mechanics, so the discrepancy is expected and not a data error. No signals conflict in a way that changes the verdict: patch now through normal update cycles, but this is not an emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a Chrome user (prior to 154.0.8037.97) into visiting it. A crafted HTML page triggers an integer overflow in the Compositing component, causing the renderer to leak memory containing cross-origin data the attacker's origin should not be able to read. No public exploit code has been identified at time of analysis, and successful exploitation requires the victim to navigate to attacker-controlled content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
Integer overflow in Google Chrome's Compositing component affects all builds prior to 154.0.8037.97 and allows remote attackers to leak cross-origin data when a victim navigates to a crafted HTML page (CVSS 4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw is unauthenticated from a network perspective but requires user interaction - the victim must actively load attacker-controlled content - and it is confined to confidentiality impact, with no integrity or availability effect; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. EPSS probability is low at 0.18% (6th percentile) and CISA's SSVC rates exploitation as none and automatable as no, so this is a moderate-priority patch rather than an emergency one.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome to 154.0.8037.97 or later through the Stable Channel update described at chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html; restart the browser after the update so the new binary is loaded, and verify the installed version via chrome://version. Because the bug is not automatable (SSVC Automatable: no) and no public exploit has been identified, emergency out-of-band action is not required, but organizations should fold the upgrade into their normal Chrome cadence so the cross-origin leak path is closed before any proof-of-concept materializes. If immediate upgrade is impossible, compensating controls carry real trade-offs: disabling hardware-accelerated compositing or GPU rasterization (e.g., launching with GPU/compositing features disabled) may reduce exposure but degrades rendering performance and can break WebGL or video sites, while enforcing strict cross-origin isolation (COOP/COEP) and restrictive Content-Security-Policy plus site-isolation flags can limit which origins are reachable from a crafted page but will break legitimate third-party embeds. Blocking untrusted or unknown origins at a proxy or browser policy layer reduces the attack surface but is brittle and high-maintenance; none of these equals patching, so treat them as temporary stopgaps only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190, an integer overflow, occurring within Chrome's Compositing subsystem - the Chromium/Blink layer that assembles painted layers, handles GPU-accelerated rasterization and transforms, and composites them into the final frame. An arithmetic overflow when computing compositing-layer geometry or buffer sizes can produce a memory-safety or logic condition that permits cross-origin data to be observed by attacker-controlled page content, which is why the impact is scoped to confidentiality (C:L) rather than code execution. CPE data identifies the affected product as cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (all Chrome releases before 154.0.8037.97), and the Chromium issue tracker entry (issues.chromium.org/issues/556268833) is the upstream engineering record for the fix. No non-default configuration is required because the vulnerable compositing path is exercised by default rendering, but the attack still depends on rendering attacker-supplied markup in the victim's browser.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page with no privileges but requiring victim navigation (UI:R); impact is a bounded cross-origin read, so C:L only with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB