EUVD-2026-93628
GHSA-3vqq-w895-v5vc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to malicious site
-
ExploitServe crafted HTML page
-
ExecutionAbuse Permissions to bypass site isolation
-
ImpactLeak cross-origin information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in the Permissions component of Google Chrome before version 155.0.8059.39 (UI:R in the provided vector), so a user must be socially engineered into visiting a crafted HTML page - there is no fully drive-by, zero-interaction path. No authentication is required (PR:N). The impact is limited to disclosure of information across the site-isolation boundary; it does not, per the description, provide code execution, data modification, or denial of service. Limiting factors: required user interaction, a fixed version is already available, and the leak is confined to information rather than control. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The input CVSS base score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) is inconsistent with the vulnerability class: the description is an information leak (CWE-200) enabling a site-isolation bypass, which Chromium itself rated 'Low'. An information disclosure flaw does not plausibly carry High integrity (I:H) and Low availability (I:H/A:L) impact, so the 9.6 appears to be an inflated/auto-generated score rather than a vendor-assessed one - treat it with skepticism and prefer the Chromium 'Low' rating. Corroborating low-risk signals: EPSS is 0.18% (7th percentile), indicating very low near-term exploitation probability; there is no CISA KEV listing and no public exploit identified. The attack also requires user interaction (UI:R) - the victim must load a crafted HTML page - which further limits mass exploitation. Net assessment: despite the headline 9.6, this is a low-real-risk issue (a narrow cross-origin information leak) that is already patched; it warrants routine browser-update hygiene, not emergency response. The only elevating factor is Chrome's ubiquity, which means even a low-severity bug reaches an enormous installed base. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a Chrome user (prior to 155.0.8059.39) into visiting it. The crafted page abuses the Permissions component to bypass site isolation and read information that should be confined to another origin. No public exploit code has been identified, and success depends on the victim actively loading the attacker's page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Information disclosure in the Permissions component of Google Chrome before 155.0.8059.39 allows a remote, unauthenticated attacker to bypass the browser's site-isolation boundary by luring a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) - the target must visit attacker-controlled content - and the resulting impact is limited to leaking information across origins rather than code execution, data modification, or denial of service. A vendor fix is already available in 155.0.8059.39, there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating a low near-term exploitation likelihood.
RemediationAI
Vendor-released patch: Google Chrome 155.0.8059.39 (stable channel) - upgrade to that build or later, which is the only complete fix for the Permissions logic at fault. The standard path is to let Chrome's built-in updater complete, then fully restart the browser so the new binary is loaded (a restart is required even after the update downloads), and verify the applied version at chrome://version or via the vendor advisory https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html. Managed environments should push 155.0.8059.39 through their enterprise software-deployment tooling rather than relying on user-initiated updates, and should audit any update-policy overrides that hold endpoints on older channels. Until the upgrade lands, compensating controls are limited because the vulnerable surface is the browser's own cross-origin isolation boundary: keeping Site Isolation enabled (its default state on desktop) remains the primary structural mitigation and should not be disabled for convenience, and the same applies to the stricter SitePerProcess setting; additionally, restrict browsing of untrusted or attacker-supplied HTML to a separate, disposable profile or a sandboxed/disposable VM so that any cross-origin information leaked is not co-located with sensitive authenticated sessions, and enforce enterprise URL allow/block policies to reduce the chance of users being socially engineered onto crafted pages (trade-off: allow-listing is disruptive to legitimate business browsing and requires ongoing maintenance). Disabling the Permissions API or site permissions wholesale is not a practical mitigation, since it breaks core site functionality (geolocation, notifications, media capture) without closing the information leak; note also that no vendor-supplied workaround is documented beyond applying the fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) located in Chrome's Permissions subsystem, the Chromium component that brokers permission grants and queries (geolocation, notifications, camera/microphone, clipboard, etc.) between renderer processes and the browser process. Chromium's site isolation model assumes that content from different sites is placed in separate renderer processes so that a compromised or malicious renderer cannot read cross-origin data or invoke privileged browser-side interfaces; the affected Permissions logic apparently exposes state or capability across that boundary when a crafted HTML page manipulates permission queries, allowing a remote attacker who can get a page rendered to learn information about another origin. The supplied CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is unversioned, so it must be read together with the vendor advisory scope: all Google Chrome builds prior to 155.0.8059.39 on affected platforms. Notably, the raw CVSS score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L) is inconsistent with both the description ('Information leak', Chromium severity: Low) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), which scores only confidentiality loss across a scope change with no integrity or availability impact; the higher figure should be treated as an unscored/vendor-supplied artifact rather than a credible indication of remote code execution or data tampering, and prioritization should follow the assessed vector.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Remote crafted page with no auth but required user interaction (UI:R); site-isolation bypass crosses a security boundary (S:C); impact is a limited information leak only, so C:L and I:N/A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome releases prior to 155.0.8059.39 contain a permissions flaw that can leak data between websites, weakening the browser isolation boundary that underpins how employees safely access both internal and third-party applications. Every Chrome user in the organization - managed laptops, remote workers, and BYOD devices - is potentially in scope, and a leaked cross-origin data exposure could reveal session or account information tied to business systems. Because a vendor fix is already available and there is no evidence of exploitation, this is a patch-management obligation to close on a defined schedule rather than an active incident requiring crisis response.
Apply vendor patch. Vendor-released patch: 155.0.8059.39. Until endpoints are confirmed updated, restrict access to high-sensitivity web applications to managed browsers only, enable Chrome auto-update where policy currently blocks it, and maintain network-level filtering of untrusted or uncategorized sites to reduce the likelihood of a user loading attacker-controlled content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB