EUVD-2026-93821
GHSA-5vx2-6rj8-rqr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger integer overflow in Compositing
-
ImpactLeak cross-origin data to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML content in a vulnerable Chrome desktop build prior to 155.0.8059.39 (UI:R), so a social-engineering or malicious-site/malvertising vector is needed - there is no fully passive or server-side trigger. The integer overflow is in Chrome's Compositing component and is reachable against default browser configuration (no special Chrome setting or flag is implied by the advisory). The primary limiting factors are: mandatory user interaction (visiting or rendering the crafted page), the impact being confined to cross-origin data disclosure (no code execution, integrity, or availability impact stated), and Chrome's automatic background update mechanism, which rapidly closes the window of exposure for most installations. |
| Impact | This is a moderate-severity, low-real-risk issue despite the 'High' Chromium internal severity label. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - network-reachable and unauthenticated, but requiring user interaction (victim must visit a crafted page) and yielding only limited confidentiality impact (cross-origin data leak), with no integrity or availability impact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or available exploit code; this is not a CISA KEV entry. The signals are internally consistent - the CVSS vector matches the description (remote, crafted HTML page, user must load it, information disclosure only). The combination of required user interaction, low scope of impact, and the fact that Chrome auto-updates mean this is a standard browser-patch-cycle issue rather than an emergency. Prioritize via normal Chrome update enforcement, not out-of-band response. Note: EPSS and SSVC data are absent from the input and cannot be assessed. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page containing crafted content that triggers an integer overflow in Chrome's Compositing component when rendered. A victim using a vulnerable Chrome build (prior to 155.0.8059.39) visits the page, and the flaw allows the attacker's page to read data belonging to a different origin, bypassing the same-origin policy. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Cross-origin data disclosure in Google Chrome desktop (Compositing component) affects builds prior to 155.0.8059.39, where a remote attacker can use a crafted HTML page to exploit an integer overflow and read limited data belonging to another origin. Exploitation is not passive: per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) the victim must load the attacker-controlled page, so a malicious-site, malvertising, or social-engineering delivery is required, and the impact is confined to low-confidentiality leakage with no integrity or availability effect. No public exploit code has been identified at time of analysis - this is not on CISA KEV - and the vendor patch is already available, meaning the effective window is mostly determined by how quickly browsers auto-update; despite the 'High' Chromium internal severity label, this is a moderate-severity, low-real-risk issue.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later; this is delivered through the normal stable-channel update (Settings > About Chrome triggers a manual check, and Chrome's background updater applies it automatically), after which the browser must be fully restarted - including any lingering background processes - and the running build confirmed at chrome://version. Because the fix is a version bump in shared Chromium Compositing code, downstream Chromium-based browsers should be updated only once their maintainers ship a rebase that includes the corresponding upstream change, and organizations that defer Chrome updates via enterprise policy should shorten that deferral for this release. There is no meaningful configuration-level workaround: the integer overflow is reachable against default settings and does not depend on an optional feature flag, and rendering untrusted HTML is the browser's core function, so 'disable Compositing' is not an available mitigation. Compensating controls are therefore exposure-reduction only and each carries a trade-off: enforce site isolation defaults with no exceptions (already default, but verify no legacy flags such as --disable-site-isolation-trials are deployed, since relaxing isolation widens leak scope), restrict high-value browsing to a curated allowlist or isolated environment for users who cannot update immediately (reduces convenience and usability), and reduce extension/embedded-content surface where feasible (breaks functionality for the affected extensions). Reference advisories: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and https://issues.chromium.org/issues/553454734.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-190 (Integer Overflow or Wraparound) occurring in Chrome's Compositing layer - the graphics path that combines rendered layers into the final frame for display. The Compositing component handles size, offset, and buffer-related arithmetic for layers and surfaces; an unchecked arithmetic operation on attacker-influenced input can wrap and yield an undersized or misaligned value, which in turn allows the browser to read past the intended boundary of one origin's rendered content and expose it to the attacker's page. This is why the CWE maps to a confidentiality-only outcome rather than memory corruption with code execution. The affected product is identified by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for builds before 155.0.8059.39, and the reference issue is tracked upstream as Chromium issue 553454734 with an ENISA EUVD entry (EUVD-2026-93821) mirroring the same version data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page with no auth gives AV:N/AC:L/PR:N, but the victim must load the page (UI:R); impact is limited cross-origin read, so C:L, I:N, A:N, S:U.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Exploit-DB