EUVD-2026-93601
GHSA-wrqw-392v-qf3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers DevTools authorization flaw
-
ExecutionBypass local system access restriction
-
ImpactLimited unauthorized read/modify of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.39), and relies on Chrome's DevTools authorization logic incorrectly granting access that bypasses local system access restrictions. The key limiting factors are: mandatory user interaction (victim must load the malicious page, UI:R), the fix shipping in 155.0.8059.39 so patched/auto-updated clients are not affected, and the narrow, partial impact (Chromium-rated Low, only limited confidentiality/integrity). No elevated privileges or authentication are needed on the attacker side (PR:N), but the DevTools-specific code path constrains realistic abuse. |
| Impact | This is a genuinely low-priority issue despite a 'medium' 5.4 CVSS base score, and multiple independent signals agree. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) describes a network-reachable but user-interaction-dependent flaw with only Low partial confidentiality and integrity impact and no availability impact. EPSS is very low at 0.12% (2nd percentile), the SSVC decision framework reports Exploitation: none, Automatable: no, and Technical Impact: partial, and there is no CISA KEV listing and no public exploit identified. Google/Chromium itself rated this 'Low' severity. One point worth verifying: the human description calls this a 'local attacker' bypassing 'system access restrictions,' which appears to conflict with the network vector (AV:N) in the CVSS string - in practice this is reconciled because exploitation occurs when the victim loads a crafted HTML page in the browser (network delivery, UI:R), while the 'local' framing refers to the local system-access restriction being bypassed by DevTools. No key signals conflict in a way that raises priority; all point to low real-world risk. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Chrome user into visiting it; the page abuses an incorrect-authorization flaw in DevTools to bypass local system access restrictions, gaining limited unauthorized read/modify capability. Exploitation requires the victim to interact with the malicious page (UI:R), and no public proof-of-concept or active exploitation has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Incorrect authorization in Chrome's DevTools component lets a crafted HTML page bypass local system access restrictions in Google Chrome builds prior to 155.0.8059.39, yielding limited confidentiality and integrity impact against the browsing user. Exploitation is unauthenticated on the attacker side (PR:N) but requires the victim to load the attacker-controlled page (UI:R), and the DevTools-specific code path keeps realistic abuse narrow, consistent with Chromium's 'Low' severity rating and a partial technical impact under CISA SSVC. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (2nd percentile), SSVC records exploitation as 'none' and automation as 'no', and the vendor has released a patched version.
RemediationAI
Vendor-released patch: 155.0.8059.39 - upgrade Google Chrome to version 155.0.8059.39 or later, which is the fix shipped in the stable channel update described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html (technical detail in https://issues.chromium.org/issues/513383360). Most consumer and managed installs will pick this up automatically via Chrome's updater; verify the running version through chrome://settings/help or the browser's 'About' page, and enterprise administrators should confirm managed devices have applied the release. Because this is not confirmed as actively exploited (no CISA KEV entry, SSVC exploitation 'none', EPSS 0.12%), it does not warrant emergency out-of-band deployment, but it should be folded into the normal patch cycle. Where patching must be deferred, the most targeted compensating control is to restrict DevTools availability for untrusted or ordinary browsing users via Chrome's enterprise DeveloperToolsAvailability policy (setting it to disable DevTools), which removes the affected code path at the cost of breaking developer workflows and self-service diagnostics on those machines; optionally combine this with blocking or restricting the loading of untrusted crafted HTML content and isolating end users from sensitive local resources via OS-level access controls, understanding that such measures reduce, but do not eliminate, the underlying incorrect-authorization weakness.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863, Incorrect Authorization: in Chrome's DevTools subsystem an authorization decision that should enforce system access restrictions was implemented incorrectly, so a page loaded in the browser could reach functionality the policy was meant to deny. DevTools is architecturally privileged - the frontend runs in a renderer context while the backend brokers powerful capabilities (page inspection, debugging, file and system-level access paths) on behalf of the user - which is precisely why a flawed authorization check there can translate into bypassing local system access restrictions rather than merely a page-level scripting issue. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N describes a network-reachable, low-complexity attack with no attacker privileges, gated by required user interaction, scoped only within the vulnerable component (S:U) and capped at partial confidentiality and integrity with no availability effect. Affected builds are captured by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (all Chrome versions before 155.0.8059.39); EUVD-2026-93601 mirrors the same pre-155.0.8059.39 range. Because the impact stays partial and the code path is DevTools-specific, this is a low-priority hardening issue rather than a mass-exploitation candidate.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Delivered via a crafted HTML page so AV:N/AC:L/PR:N, but the victim must load the page (UI:R); impact is limited local-restriction bypass, hence C:L/I:L/A:N and unchanged scope.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB