EUVD-2026-93744
GHSA-9m75-x863-m4qg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitSpoof Chrome FileSystem access UI
-
ExecutionDeceive user into granting access
-
ImpactBypass system access restrictions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the FileSystem (File System Access) feature flow in Chrome and, critically, active victim participation: the attacker must use social engineering to get a user to visit a crafted HTML page and then interact with a spoofed/misrepresented UI element so the user is deceived into permitting access (UI:R in the CVSS vector). Limiting factors: the attack cannot succeed without a human being misled and interacting, there is no server-side or automated trigger, and it only affects Chrome versions prior to 155.0.8059.39 - patched/auto-updated clients are not exploitable. Impact is constrained to low confidentiality and low availability with no integrity effect. |
| Impact | This is a Medium-severity (CVSS 5.4) UI misrepresentation / spoofing flaw (CWE-451) in Chrome's FileSystem component, and the signals consistently point to a moderate, not a top-tier, priority. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) shows a network-reachable, low-complexity, unauthenticated bug, but the mandatory UI:R and the description's explicit reliance on social engineering mean exploitation hinges on tricking a human, which sharply limits scalability and automatability. Impact is bounded: low confidentiality and low availability, no integrity impact, and no scope change. There is no CISA KEV listing and no public exploit identified in the provided data, so there is no evidence of active or at-scale exploitation. No EPSS score or SSVC decision data was supplied, so exploitation probability and the automatable/technical-impact dimensions cannot be quantified from this input - treat exploitation likelihood as unquantified rather than assume it. Net: a genuine but modest browser spoofing issue best handled through routine Chrome auto-update rather than emergency patching. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and uses social engineering (e.g., a phishing lure or deceptive prompt) to get a victim to visit it in Chrome. The page manipulates the FileSystem UI so the victim is misled about what they are authorizing, causing them to grant or accept access that bypasses intended system access restrictions. No public proof-of-concept exploit was identified in the provided data, and user interaction is required for the attack to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
UI misrepresentation in Google Chrome's File System Access (FileSystem) component affects browser builds prior to 155.0.8059.39, where a remote, unauthenticated attacker can use social engineering to trick a user into granting file access through a spoofed or misleading interface element, bypassing intended system access restrictions. Successful exploitation is limited to low confidentiality and low availability impact with no integrity effect (CVSS 5.4, CWE-451), and depends entirely on victim interaction: the user must first be lured to a crafted HTML page and then engage with the misrepresented prompt. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the vendor has shipped a fixed release, so exposure is largely confined to users running outdated, non-auto-updated Chrome installations.
RemediationAI
Vendor-released patch: update Google Chrome to 155.0.8059.39 or later, available through the stable channel update documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; because Chrome auto-updates, the fastest path is to relaunch the browser after an update check and verify the version under chrome://version, since the fix only takes effect after the running process is restarted. Where centralized management exists, push 155.0.8059.39 as a minimum version via enterprise policy or MDM so unmanaged or dormant devices cannot remain on vulnerable builds, using the Chromium issue https://issues.chromium.org/issues/521949525 to track technical detail. If immediate upgrade is impossible, the practical compensating control is to constrain the file-system permission surface: block or restrict file-system access prompts on untrusted origins and require, rather than auto-grant, access for sensitive sites using Chrome's FileSystemRead/FileSystemWriteAllow-and-Blocked-ForUrls-style enterprise policies, and train users not to act on unexpected file or folder permission prompts delivered from links or ads. The trade-off is that aggressive blocking breaks legitimate browser-based editors, backup tools and document workflows that depend on the File System Access API, so it should be scoped to untrusted or unknown origins rather than applied globally, and it is a stopgap only - it reduces the social-engineering payoff but does not fix the underlying UI misrepresentation, so patching to 155.0.8059.39 remains the definitive remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a user-interface misrepresentation flaw (CWE-451) in Chrome's FileSystem implementation, the browser-side surface that backs the File System Access API and its permission prompts. The API lets web applications request read or write access to files and directories chosen by the user, and the browser is responsible for rendering an accurate, trustworthy prompt so the user understands exactly what is being granted to which origin. When that presentation can be spoofed or misrepresented, a page can induce the user to believe they are approving something benign while actually granting a broader file-system permission - effectively an access-restriction bypass achieved through deception rather than a memory-safety or logic break. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L confirms the network-reachable, unauthenticated nature of the attack but anchors the severity: the Required user interaction (UI:R) is a genuine gate, the scope is unchanged, and measured impact is low confidentiality plus low availability with no integrity component. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD-2026-93744 both describe Chrome builds older than 155.0.8059.39; the Chromium security severity is Medium, consistent with the assigned 5.4 score. The associated Chromium issue (521949525) is the authoritative root-cause record, and the file-system permission model is the specific technology surface involved rather than general browsing or rendering.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Network-delivered crafted page (AV:N, AC:L) needs no attacker privileges (PR:N) but requires the victim to interact with a spoofed UI (UI:R); impact is limited to low C and A.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB