EUVD-2026-93618
GHSA-37jj-755w-p6f3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers flaw in Passwords component
-
ImpactSensitive information disclosed to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open or navigate to an attacker-crafted HTML page while running a Chrome desktop build prior to 155.0.8059.39 (UI:R); the flaw resides in the Passwords component. No authentication or special privileges are needed on the attacker side (PR:N), but the mandatory user interaction and the fact that the issue is fixed in the stable channel are the principal limiting factors. There is no indication of a non-default configuration requirement - any affected default Chrome install rendering the malicious page is in scope, but only until auto-update applies the fix. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) claims full High confidentiality, integrity AND availability impact, but the vulnerability is explicitly an information leak (CWE-200) and Google/Chromium rated it 'Low' security severity. An information disclosure flaw does not plausibly produce High integrity and availability impact, so the I:H/A:H metrics appear to be a generic/templated CNA score rather than a true reflection of this bug - treat the 8.8 as overstated. No EPSS score, KEV listing, or POC was provided; per the inputs there is no public exploit identified at time of analysis, and Chrome bugs reported internally ('Reported by: Chrome') with a Low rating are rarely exploited at scale. Realistically this is a low-to-moderate priority: a vendor patch exists, the issue requires user interaction (visiting a crafted page), and the vendor's own severity triage says Low. Recommend patching via normal Chrome auto-update cadence rather than emergency out-of-band action. Key caveat to verify with vendor: the CVSS C/I/A=High metrics are inconsistent with a Low-rated information leak. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a victim running a pre-155.0.8059.39 Chrome build to visit it (malvertising, phishing link, or compromised site). When the page renders, a flaw in the Passwords component leaks sensitive information back to attacker-controlled content. No public exploit code is identified in the provided data, and success depends on the victim actively opening the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in the Passwords component of Google Chrome desktop builds prior to 155.0.8059.39 lets a remote, unauthenticated attacker obtain sensitive data when a victim renders a crafted HTML page. The vendor rates the issue Chromium security severity Low, and the independent assessment converges on a limited-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) rather than the 8.8 figure carried in some feeds, so the mandatory user interaction and the low-confidentiality scope are the real risk drivers. There is no public exploit identified at time of analysis, and a vendor patch is already shipping in the stable channel as 155.0.8059.39.
RemediationAI
Apply the vendor-released patch by upgrading Chrome to 155.0.8059.39 or later through the stable channel (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html), and verify that auto-update has actually applied it on managed desktop fleets, since the window of exposure lasts only until the fix lands. Where immediate fleet-wide updating is not possible, the practical compensating control is to reduce the value of the exposed data: set the enterprise policy PasswordManagerEnabled=false to stop Chrome from storing and autofilling passwords, with the trade-off that users lose saved-credential convenience in the browser and may shift to weaker external password storage. Restricting browsing to trusted sites or blocking untrusted HTML is not realistically enforceable and is not a substitute for patching, and no server-side or network control addresses a client-side, user-interaction-driven rendering flaw. Monitor the Chromium issue tracker entry for any follow-up fix revisions, and treat the conflicting 8.8 feed score as superseded by the vendor's Low severity rating and the limited-confidentiality independent assessment when prioritizing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-200 Exposure of Sensitive Information, located in Chrome's Passwords component - the subsystem that stores, autofills, and displays saved credentials through the built-in password manager. A crafted HTML page rendered by an affected desktop build causes data held within that component's UI or rendering path to be exposed to the page. The authorization model is remote and unauthenticated (PR:N per the CVSS vector), but exploitation is gated by user interaction (UI:R): the victim must actually open or navigate to the attacker-supplied page. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is version-agnostic, so the authoritative affected boundary is the vendor advisory range of releases prior to 155.0.8059.39 on the desktop stable channel; the reported Chromium severity is Low, consistent with the independently assessed confidentiality-only impact (C:L/I:N/A:N) rather than the higher 8.8 score present in the supplied feed data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim interaction (UI:R, PR:N); as a CWE-200 info leak it has limited confidentiality impact (C:L) and no integrity or availability impact, matching the vendor's Low rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome desktop users on versions before 155.0.8059.39 are exposed to an information-disclosure issue in the Passwords component that could reveal password-related data when a user renders a crafted HTML page. The issue requires user interaction and is assessed as limited confidentiality impact, with no public exploit identified at time of analysis, but unpatched browsers across the workforce still create a credential-exposure risk. Security leadership should treat this as a patch-management priority because the vendor fix is already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB