EUVD-2026-93811
GHSA-mq2w-v72p-jfjf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process via separate bug
-
ExploitLure victim to crafted HTML page
-
ExecutionAbuse Omnibox incorrect authorization check
-
ImpactExfiltrate sensitive cross-context information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has FIRST compromised Chrome's renderer process (per the description), then needs the victim to visit a crafted HTML page (UI:R) targeting the Omnibox's incorrect authorization logic. Limiting factors: the renderer-compromise prerequisite means this is a chained/post-exploitation primitive rather than a standalone remote bug; high attack complexity (AC:H) and required user interaction further constrain it; impact is limited to disclosure of sensitive information (no integrity or availability effect). Affects Chrome versions prior to 155.0.8059.39 across standard desktop configurations. |
| Impact | This is a moderate-severity information-disclosure flaw whose real-world risk is meaningfully lower than its High Chromium severity label might suggest. The CVSS 3.1 base score is only 5.3 (Medium), and the vector tells a consistent story: AV:N but AC:H and UI:R, meaning exploitation is network-reachable yet non-trivial and requires victim interaction (visiting a crafted page). Critically, the description states the attacker must have ALREADY compromised the renderer process - a substantial precondition that the PR:N metric does not capture (it is encoded instead as AC:H). All three threat signals align toward low urgency: CISA SSVC lists Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public POC identified in the provided data. The impact is confined to confidentiality (C:H/I:N/A:N) with no scope change (S:U). Bottom line: this is a defense-in-depth sandbox/authorization weakness that matters as part of a chained renderer-escape attack, not a standalone remotely-weaponizable bug - patch it on the normal Chrome update cadence rather than as an emergency. |
| Exploit ScenarioDerived | An attacker who has already gained code execution in Chrome's renderer process (e.g., via a separate memory-corruption bug) lures a victim to a crafted HTML page; the renderer then abuses the Omnibox's incorrect authorization check to read sensitive information it should not be able to access. No public exploit code was identified at time of analysis, and the attack is not automatable per SSVC, so it would appear in targeted exploit chains rather than mass campaigns. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in Google Chrome's Omnibox affects versions prior to 155.0.8059.39, where a remote attacker who has already compromised the browser's renderer process can obtain sensitive information by enticing the victim to open a crafted HTML page. Exploitation is constrained by the renderer-compromise prerequisite, high attack complexity (AC:H), and required user interaction (UI:R), and the resulting impact is limited to confidentiality (C:H, I:N, A:N), consistent with a CVSS 3.1 base score of 5.3 and CWE-863 incorrect authorization. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none; a vendor patch (155.0.8059.39) is available.
RemediationAI
Upgrade to Google Chrome 155.0.8059.39 or later; the vendor-released patch is included in the Chrome stable channel update referenced at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html. Desktop users can trigger the update via Settings > About Chrome and must fully restart the browser for the new build to take effect; enterprises should confirm fleet version compliance through Chrome Browser Cloud Management or their software-deployment tooling and verify browsers report 155.0.8059.39+ before considering the exposure closed. Chromium-derived browsers should be updated once their maintainers rebase past the upstream fix (tracked at https://issues.chromium.org/issues/540018068). No practical feature-disable workaround exists for the Omnibox authorization defect, so the reliable mitigation is prompt patching; compensating controls such as keeping site isolation enforced, avoiding untrusted pages in the same profile, and monitoring for renderer-exploit chains reduce the chained-attack precondition but do not fix the flaw, and delaying patching leaves a low-likelihood but unpatched information-disclosure primitive in place. No public exploit code has been identified, and no vendor patch absence applies here since a fixed version is available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Omnibox, Chrome's address-bar and search-suggestion interface, which lives in the privileged browser process while page content executes in a sandboxed renderer. The root cause class is CWE-863 (Incorrect Authorization): an interface or IPC endpoint associated with the Omnibox fails to enforce the proper authorization check, so a renderer that has already been compromised can request or receive data outside its intended trust boundary and leak sensitive information to a crafted page. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N reflects that the attack is network-deliverable but requires the prior renderer compromise plus victim interaction, is unauthenticated from the perspective of the CVSS privilege-required metric (PR:N), and yields only confidentiality loss with no scope change, integrity, or availability effect. The Chromium issue tracker entry (issues.chromium.org/issues/540018068) is the upstream root-cause record, and the affected CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome builds released before the fixed version.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable via crafted page (AV:N, UI:R); the mandatory prior renderer compromise and non-trivial trigger justify AC:H; confidentiality-only disclosure gives C:H/I:N/A:N, scope unchanged.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB