EUVD-2026-93707
GHSA-38pg-jw2j-v927
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish crafted Chrome extension
-
ExploitVictim installs malicious extension
-
ExecutionBypass cross-origin authorization check
-
ImpactExfiltrate cross-origin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to install an attacker-controlled, specially crafted Chrome extension (reflected by UI:R in the CVSS vector) running on Chrome before 155.0.8059.39; the flaw lies in the Extensions component's authorization handling. Limiting factors: the attacker must first get the malicious extension onto the victim's browser (social engineering, Web Store approval, or sideloading), there is no privileged access needed by the extension itself (PR:N), and impact is confined to reading cross-origin data (C:L) with no integrity or availability effect, so it cannot modify data or crash the browser. |
| Impact | This is a genuinely moderate, not high-priority, issue and the signals are consistent across sources. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) and Chromium's own 'Medium' severity rating agree: remote, low-complexity, no privileges, but requiring user interaction (installing a crafted extension), with only low confidentiality impact and no integrity or availability impact. CISA's SSVC decision framework reinforces the low urgency - Exploitation: none, Automatable: no, Technical Impact: partial - meaning no observed exploitation and the attack cannot be reliably scripted at scale. No EPSS score was provided, the CVE is not on the CISA KEV list, and no public POC is referenced, so there is no public exploit identified at time of analysis. The one point worth flagging: the 'Authentication Bypass' tag conflicts with the actual weakness, CWE-863 Incorrect Authorization, and the description ('obtain cross-origin data') - this is an authorization/same-origin-policy weakness, not an authentication bypass; treat the tag as imprecise. Net: real but low-to-medium priority, driven down by the user-interaction requirement and read-only, cross-origin-data-only impact. |
| Exploit ScenarioDerived | An attacker publishes a malicious Chrome extension (e.g., to the Web Store or via sideloading) and convinces a victim to install it. Once installed, the extension abuses the incorrect authorization flaw to read data across origin boundaries that it should not be permitted to access, exfiltrating sensitive cross-origin content from the victim's browsing sessions. No public exploit identified at time of analysis, and SSVC lists exploitation as none. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Cross-origin data disclosure in Google Chrome before 155.0.8059.39 results from incorrect authorization logic in the browser's Extensions component, which lets a specially crafted Chrome extension read data across origin boundaries that the extension permission model should have blocked. Reaching the flaw requires a remote attacker to convince a victim to install that crafted extension (UI:R); the extension itself needs no elevated privileges (PR:N), and the resulting impact is limited to confidentiality (C:L) with no integrity or availability effect, so data cannot be altered and the browser cannot be crashed. There is confirmed actively exploited status is not present - no CISA KEV listing - and no public exploit code identified at time of analysis, with SSVC scoring Exploitation: none, Automatable: no, Technical Impact: partial, and Chromium rating the issue Medium severity.
RemediationAI
Vendor-released patch: 155.0.8059.39 - upgrade Google Chrome to 155.0.8059.39 or later via the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; in practice Chrome's auto-update delivers this, so verify version state at chrome://settings/help and restart the browser to apply it, and confirm the technical fix in https://issues.chromium.org/issues/513741326. Because the flaw lives in the browser's own authorization checks rather than in any extension permission, there is no per-site or per-extension workaround that fully closes it before patching; the practical compensating controls are administrative - enforce enterprise extension policy (ExtensionInstallAllowlist, ExtensionInstallBlocklist, or ExtensionSettings) to permit only reviewed extensions and block unknown ones from the Web Store or sideloading, and disable developer mode so unsigned extensions cannot be loaded. The trade-off is real: allowlisting breaks legitimate unlisted extensions and adds ongoing catalog maintenance for administrators, and it only reduces the attack surface for delivering the malicious extension rather than eliminating the underlying cross-origin disclosure, so it should be treated as a stopgap until the browser is upgraded. Given the low confidentiality-only impact and no confirmed exploitation, emergency out-of-band measures are not warranted, but standard patch-SLA cycling to 155.0.8059.39 should occur promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Chrome's Extensions subsystem, the component that brokers permissions, host access, and message passing between installed extensions and web content. The root cause is CWE-863 (Incorrect Authorization): an authorization check governing which origins an extension may read was implemented incorrectly, so a crafted extension can obtain cross-origin data it should not be entitled to. This is a browser-enforced trust boundary issue rather than a classic memory-safety bug, and it sits in the same class as other Chrome extension privilege-escalation and cross-origin leak issues that hinge on the gap between declared extension permissions and what the runtime actually enforces. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N places the attack over the network with low complexity, no privileges required, and mandatory user interaction (the install), scoped entirely to a low-confidentiality impact; the generic CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* tracks all Chrome builds below the fixed release. Because the defect is in extension authorization rather than a web-exposed parsing or rendering path, exploitation is not automatable in the SSVC sense and depends on delivery of a malicious extension through social engineering, Web Store approval, or sideloading.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
User must install a crafted extension (UI:R) but no prior privileges are needed (PR:N); impact is read-only cross-origin disclosure, so C:L and I/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB