EUVD-2026-93585
GHSA-p7xj-pmcw-fgmx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to open link
-
ExploitTrigger incorrect authorization in UI
-
ExecutionEscape renderer sandbox
-
ImpactExecute arbitrary code on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively open an attacker-controlled crafted HTML page in a vulnerable Chrome build (any version prior to 155.0.8059.39) - this user-interaction requirement (UI:R in the CVSS vector) is the primary limiting factor and means it cannot be triggered fully remotely without victim action. No authentication is required (PR:N) and no special Chrome configuration is indicated in the description; the flaw is an incorrect-authorization condition in the browser UI (CWE-863) that enables escaping the renderer sandbox. Realistic risk is bounded by the need to deliver the page and have the user load it, and by Google's own MEDIUM severity rating despite the sandbox-escape potential. |
| Impact | Signals are mixed and warrant careful weighting. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) describes a network-reachable, low-complexity, unauthenticated sandbox escape leading to full code execution - a severe profile. However, Google's own Chromium security team rated this only MEDIUM, a direct conflict with the 9.6 CRITICAL numeric score; this gap typically reflects that exploitation requires chaining, non-trivial conditions, or that the UI:R user-interaction requirement meaningfully limits mass exploitation. No EPSS probability was provided, the CVE is NOT in CISA KEV, and no public POC was supplied, so there is no evidence of active exploitation - status is 'no public exploit identified at time of analysis.' The one hard mitigating factor confirmed by data is UI:R: the victim must open a crafted HTML page. Net: a patch-now item on the standard Chrome update cadence given Chrome's ubiquity and the sandbox-escape potential, but there is no signal (no KEV, no EPSS, no POC) elevating it to emergency out-of-band status. Treat the 9.6 as a theoretical ceiling tempered by the vendor's MEDIUM rating. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing crafted HTML that abuses the incorrect-authorization flaw in Chrome's UI, then lures a victim into visiting it (phishing link, malvertising, or watering-hole). When the page loads, the flaw is triggered to break out of the renderer sandbox and potentially run arbitrary code on the victim's host with the browser user's privileges. No public exploit code was identified in the provided data, so this is a plausibility assessment rather than a confirmed weaponized chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Incorrect authorization in the Google Chrome user-interface layer allows a crafted HTML page to escape the renderer sandbox and execute arbitrary code outside it on all Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to open an attacker-supplied page (UI:R in the assessed vector) and, while no authentication is required (PR:N) and no unusual configuration is needed, the attack is not fully remote - it depends on that user action, which is the main limiting factor. Severity signals are mixed: the assessed CVSS vector scores 9.6 with scope change (S:C) and high confidentiality, integrity and availability impact, yet Google rates the underlying Chromium issue as Medium, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later; per Google's Stable channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html) the issue is fixed in that build and the vendor-released patch is available, so the primary action is to confirm the version via chrome://version and force the update where automatic updating is delayed. Because Chrome patches often require a full browser restart before the new binary is active, verify that every running instance, background process and persistent session has actually relaunched - a common gap in long-lived enterprise sessions and kiosks. Where immediate fleet-wide upgrade is not possible, compensating controls with explicit trade-offs include: enforcing enterprise update policies (Chrome Browser Cloud Management or the RelaunchNotification/UpdateDefault group policies) to force the 155.0.8059.39 rollout on a short deadline, at the cost of user-session interruptions; blocking or sandboxing access to uncategorized and newly registered sites at the secure web gateway, which reduces delivery paths for the crafted page but breaks legitimate browsing and generates false positives; and hardening the renderer side by keeping Site Isolation enabled (do not disable it for performance or compatibility), noting that isolation is a defense-in-depth layer and not a confirmed containment for this specific authorization flaw. Disabling JavaScript or the affected UI feature outright is not a practical option for general use and would break most web applications, so patching remains the only complete mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863 (Incorrect Authorization). Chrome separates untrusted web content into a sandboxed renderer process and performs privileged operations - window management, navigation, file and OS interactions, and other browser-level capabilities - in a trusted browser process reached through IPC. In this case the UI/authorization checks that gate one of those privileged operations are performed incorrectly, so a renderer-side request that should have been rejected is honored, giving the attacker a bridge out of the sandbox to arbitrary code execution in the browser process or on the host. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a network-delivered page (AV:N) that needs no credentials (PR:N) but does need the victim to load it (UI:R), with the successful escape crossing a security boundary and thus changing scope (S:C). The supplied CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is a wildcard covering every Chrome release below the fixed build; EUVD-2026-93585 records the same affected range (Chrome 155.0.8059.39 < 155.0.8059.39, i.e. prior builds). Google's own Medium rating indicates the issue is real but narrower in practical exploitability than the raw vector might suggest.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-delivered crafted page with no auth (AV:N/PR:N) but requiring the victim to open it (UI:R); sandbox escape crosses a trust boundary (S:C) yielding full code execution (C/I/A:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain a critical sandbox-escape flaw that could let a crafted web page run malicious code on employee endpoints, potentially exposing corporate data and enabling further network compromise if users open attacker-controlled content. Because Chrome is a core business application across the workforce, unpatched systems create a broad and urgent remediation obligation, though there is no public exploit identified at time of analysis and Google has released a fixed version. Leadership should prioritize enterprise-wide browser updates to reduce the risk of endpoint compromise and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB