EUVD-2026-93636
GHSA-p69g-86pm-5hp9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage loads in Chrome Transactions Platform
-
ExecutionBypass incorrect authorization check
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim running Google Chrome for Android prior to 155.0.8059.39 to actively open an attacker-crafted HTML page (UI:R) that targets the Transactions Platform component; no authentication or prior privileges are needed (PR:N) and the attack is fully remote (AV:N). The primary limiting factor is the mandatory user interaction - the victim must be lured into loading the malicious page - plus the narrow platform scope (Chrome on Android, not desktop) and the need for the vulnerable version to be installed. Impact per the description is limited to disclosure of sensitive information, not code execution. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The input CVSS base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), which rates High/Critical and claims full confidentiality, integrity, AND availability impact - yet the Chromium security severity is explicitly 'Low' and the description only describes the ability to 'obtain sensitive information' (a confidentiality-only outcome). The C:H/I:H/A:H triad is therefore not supported by the description, which implies C:H/I:N/A:N at most; the 8.8 appears inflated relative to both Google's own triage and the stated behavior. No EPSS score, KEV listing, POC, or SSVC data is provided. Exploitation status is 'no public exploit identified at time of analysis.' Realistically this is a low-to-moderate priority browser information-disclosure bug that requires user interaction (victim must load a crafted page), not a wormable critical - treat the 8.8 as an outlier and defer to the vendor 'Low' rating and confidentiality-only description. Patch to 155.0.8059.39+ via normal Chrome update cadence; no emergency response indicated by available signals. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a Chrome-for-Android user (prior to 155.0.8059.39) to visit it, for example via a link in a message, ad, or compromised site. When rendered, the page abuses an incorrect authorization check in Chrome's Transactions Platform component to read sensitive information the origin should not be able to access. No public exploit code has been identified, and the attack requires user interaction (UI:R) but no authentication (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Google Chrome for Android prior to 155.0.8059.39 contains an incorrect-authorization flaw in its Transactions Platform component that lets an unauthenticated remote attacker read sensitive information from the browser by luring the victim into opening a crafted HTML page. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, though the attack is fully remote (AV:N/PR:N) and requires only that a user on a vulnerable Android build load the attacker's page (UI:R). Note that public severity signals conflict: the vendor rates this Chromium security severity 'Low' and limits impact to information disclosure, while a widely replicated CVSS 3.1 base score of 8.8 lists high integrity and availability impact that is not supported by the description - our independent assessment scores it 8.8-adjacent only on confidentiality (C:H/I:N/A:N).
RemediationAI
Vendor-released patch: Chrome for Android 155.0.8059.39 fixes CVE-2026-106371. Update through Google Play (open the Play Store listing for Chrome and apply the pending update, or use managed Google Play / enterprise app-update policies to force the version), then confirm the build number in Chrome's Settings > About Chrome reports 155.0.8059.39 or later; because Android WebView/Chrome updates can lag on unmanaged devices, fleet-wide verification of the reported version is the only reliable confirmation of exposure. Chrome's Android release cadence means the update typically propagates automatically, so the practical gap is the window between disclosure and device uptake - prioritize devices with saved payment methods or heavy autofill usage, which are the most attractive targets for this class of authorization flaw. Before patching, no browser-level switch cleanly disables the vulnerable Transactions Platform path, so compensating controls are limited and carry trade-offs: turning off autofill for payment methods and deleting stored cards in Chrome settings reduces the value of the data reachable through the flaw at the cost of losing autofill convenience, and restricting browsing on affected devices to trusted/internal origins (or routing through a managed browser profile with URL allow-listing) lowers the chance a user is lured into loading an attacker-crafted page but degrades general usability. Network-layer content inspection is unlikely to reliably detect the attack because the malicious page is ordinary HTML, so user-awareness messaging about unsolicited links remains a secondary measure only. Track the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for any revised severity or additional affected-version detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization) in the component Chromium developers refer to as the 'Transactions Platform' - the internal surface that brokers transaction and payment-related data (for example, autofill/payment flows) between web content and the browser's privileged services. Because the authorization check on that boundary is missing or incorrect, a remote page is able to reach data it should not be permitted to read, resulting in disclosure of sensitive information rather than code execution or state corruption. The attack path is strictly network-delivered (AV:N) with no privileges required (PR:N) but does require user interaction (UI:R), meaning the victim must be induced to open the malicious HTML page; scope is unchanged (S:U). The CPE string provided (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is over-broad and covers the Chrome product family generically - the description, the ENISA EUVD entry and the vendor advisory all scope the defect to Chrome on Android only, with Chrome 155.0.8059.39 as the first fixed release, so desktop Chrome is not identified as affected. The upstream Chromium issue (issues.chromium.org/issues/553326010) is the authoritative source for reproduction details and is typically access-restricted while the fix rolls out. The mismatch between the CVSS 3.1 vector's C:H/I:H/A:H and the description's information-disclosure-only impact is the most important analytical caveat here; treat the integrity/availability components of the published score as unsubstantiated by available evidence, consistent with the vendor's 'Low' severity rating.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but victim must load it (UI:R); description states only information disclosure, so C:H with I:N/A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android versions before 155.0.8059.39 are affected by a high-severity incorrect-authorization flaw that could allow an unauthenticated remote attacker to read sensitive browser information if a user opens a crafted HTML page. This affects the mobile workforce using unpatched Android devices and creates a broad exposure surface because exploitation requires only user interaction, though no public exploit or active exploitation is currently identified. Leadership should prioritize validating Chrome for Android versions and driving the vendor patch across managed and BYOD devices to reduce confidentiality risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB