EUVD-2026-93690
GHSA-4g4h-g296-fg8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryCompromise renderer process (separate flaw)
-
ExploitTrigger improper input validation in Viz
-
ExecutionBypass system access restrictions
-
ImpactAccess resources outside renderer sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process (a prior/chained vulnerability), after which a crafted HTML page triggers the Viz improper-input-validation flaw to bypass system access restrictions. Limiting factors: user interaction is required (victim must load the malicious page, matching UI:R), the renderer must be pre-compromised before this bug is reachable, and affected deployments are Chrome versions prior to 155.0.8059.39 - fixed builds are not exploitable. Severity is Chromium 'Medium', consistent with a sandbox/defense-in-depth bypass rather than direct code execution. |
| Impact | This is a medium-severity, defense-in-depth bug rather than a standalone high-priority threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, score 6.5) describes network reachability and low complexity, but the description makes clear this is a SECOND-STAGE vulnerability: the attacker must already have 'compromised the renderer process' before the Viz input-validation flaw can be used to bypass system access restrictions. All exploitation signals agree on low real-world urgency: EPSS is 0.22% (12th percentile), CISA SSVC reports Exploitation=none / Automatable=no / Technical Impact=partial, there is no CISA KEV listing, and no public exploit was identified. The only tension is that CVSS lists PR:N while the description implies a meaningful precondition (a pre-compromised renderer) - this is Google's standard convention of scoring the sandbox/access-restriction bug in isolation, and defenders should treat the required renderer compromise as a genuine limiting factor. Net: a legitimate issue to patch via normal Chrome auto-update cadence, not an emergency. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate renderer-process vulnerability lures a victim to a crafted HTML page, then abuses improper input validation in Chrome's Viz (graphics/compositing) component to escape the renderer's intended system access restrictions. No public exploit code or active exploitation has been identified, and successful use depends on first achieving renderer compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Improper input validation in Google Chrome's Viz display/compositor component lets an attacker who has already compromised the renderer process bypass system access restrictions by enticing a victim to load a crafted HTML page, producing a high-integrity impact with no confidentiality or availability loss, and consistent with a sandbox defense-in-depth bypass rather than standalone code execution. The flaw affects Chrome builds prior to 155.0.8059.39 and was rated Chromium security severity Medium; it is not a remotely triggerable, unauthenticated compromise of a fully patched browser on its own, because the renderer must be pre-compromised first. There is no public exploit code identified at time of analysis, no CISA KEV listing, and the EPSS score is low at 0.22% (12th percentile), so this is a medium-severity patch-cycle item rather than an emergency one.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.39 and later, delivered through the Stable channel per the Chrome release advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; ensure Chrome's auto-update mechanism has applied the build (verify via chrome://version) and force a relaunch so the patched binary is actually running, since the update only takes effect on restart. Because exploitation requires the attacker to already hold a compromised renderer process, the practical priority is to break the chain: keep the browser current so upstream renderer exploits cannot be used as the first stage, maintain Site Isolation and the standard renderer sandbox enabled (both are default in supported Chrome; disabling or loosening them, or launching with --no-sandbox, removes the boundary this bug bypasses), and enforce that high-risk untrusted HTML is opened only in managed, updated Chrome profiles rather than embedded/legacy webviews. If patching cannot be applied immediately, compensating controls carry real trade-offs: restricting or blocking access to untrusted external web content trades usability for reduced exposure; deploying a web proxy or URL filtering score to block unknown/suspicious pages adds latency and false positives; and applying enterprise policy to disable risky features or force stricter content handling can break legitimate line-of-business web apps. There is no vendor-released workaround that fully substitutes for the 155.0.8059.39 upgrade, and non-Chrome Chromium-derived browsers should be upgraded as soon as their maintainers ship builds based on this fixed Chromium revision.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Viz, Chrome's GPU/display compositor service that runs outside the renderer sandbox and brokers compositing surfaces and system-level resources on behalf of untrusted renderer content. The root cause class is CWE-20 Improper Input Validation: parameters arriving over the renderer-to-Viz IPC boundary are not sufficiently validated, so a renderer that is already under attacker control can craft messages (delivered through a malicious HTML page) that Viz accepts, letting the attacker escalate out of the expected access restrictions that separate the compromised renderer from the privileged compositor. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates a network-reachable issue requiring no authentication (PR:N) but needing victim interaction (UI:R, the page load), with scope unchanged and impact limited to integrity (I:H) and no confidentiality or availability effect - the classic signature of a sandbox/privilege-boundary bypass rather than memory-corruption code execution. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome builds below the fixed release are in scope across platforms, and the EUVD entry (EUVD-2026-93690) lists the vulnerable range as Chrome versions earlier than 155.0.8059.39. CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) reinforces that the bug is neither being exploited nor trivially automatable, and Chromium's own 'Medium' severity rating is consistent with defense-in-depth value rather than a primary attack primitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Delivered via crafted HTML page requiring a user visit (AV:N/UI:R); integrity-only impact from bypassing access restrictions (I:H, C:N/A:N); scored per Chrome convention with the renderer compromise treated as a chained precondition rather than base PR.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB