EUVD-2026-93732
GHSA-8xfv-cgfx-jxmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate flaw
-
DeliveryServe crafted HTML page
-
ExploitBypass permissions authorization check
-
ExecutionSpoof UI/permission elements
-
ImpactDeceive user into trusting forged UI
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has FIRST compromised Chrome's renderer process via a separate vulnerability - this is the primary gating condition and is stated explicitly in the description. Beyond that, a victim must load an attacker-crafted HTML page (UI:R / user interaction required) in Chrome versions prior to 155.0.8059.39. The weakness is a missing authorization check (CWE-862) in the Permissions component. Limiting factors that reduce real-world risk: the mandatory prior renderer compromise, the required user interaction, high attack complexity (AC:H), and impact confined to UI spoofing rather than data theft or code execution. Patched builds (155.0.8059.39 and later) are not affected. |
| Impact | This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) yields only 4.2 (Medium), and crucially the description establishes a hard prerequisite the CVSS PR:N metric understates: the attacker must have ALREADY compromised the renderer process before this bug is reachable. This makes it a sandbox-era post-exploitation refinement (UI spoofing), not an initial-access vector - AC:H correctly reflects that dependency. All exploitation signals point the same direction and do not conflict: SSVC rates Exploitation 'none', Automatable 'no', Technical Impact 'partial'; there is no CISA KEV listing and no POC referenced in the provided intelligence; Chromium's own rating is Medium. Impact is limited to UI spoofing (C:L/A:L, no integrity or code execution). The only caveat is the PR:N vs. 'compromised renderer' tension: CVSS scores this as unauthenticated, but realistically it chains off a separate prior renderer exploit, so its standalone real-world risk is marginal. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate renderer vulnerability uses that foothold, combined with a crafted HTML page served to the victim, to manipulate permission-related UI elements and spoof trusted browser chrome or prompts, potentially tricking the user into granting a permission or trusting a forged element. No public exploit code is referenced in the provided intelligence, and the attack cannot proceed without the pre-existing renderer compromise plus user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Missing authorization checks in the Permissions component of Google Chrome prior to 155.0.8059.39 let a remote attacker who has already compromised the browser's renderer process spoof UI elements by way of a crafted HTML page. The attack is network-reachable and unauthenticated (CVSS:3.1/AV:N/PR:N) but requires high attack complexity (AC:H) and victim interaction (UI:R), and impact is limited to low confidentiality and availability effects (C:L/I:N/A:L, base score 4.2). There is no public exploit identified at time of analysis and no evidence of exploitation in CISA KEV; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this should be treated as a low-priority hardening item rather than an urgent threat. Google has shipped a fix in Chrome 155.0.8059.39.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later, as documented in the vendor's Stable Channel Update for Desktop advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html); this is a Vendor-released patch at the exact version 155.0.8059.39 and is the only complete fix. Track the underlying Chromium issue at https://issues.chromium.org/issues/517801814 for regression detail. Because exploitation depends on an attacker already controlling the renderer, the highest-value compensating control is preventing that precondition: keep the Chromium sandbox enabled (never run with --no-sandbox), disable or tightly restrict unnecessary command-line flags in managed shortcuts, and enforce site isolation so a single compromised renderer cannot reach broader browser state - the trade-off is modest additional memory and some latency on heavily framed sites. Locking the browser down via enterprise policy (forcing auto-update, restricting extension installs and unvetted third-party builds, blocking Flash-style or other legacy plugins) reduces the attack surface that would be needed to reach renderer compromise, at the cost of user flexibility. Web-content filtering to block untrusted pages that could serve the crafted HTML reduces exposure to the second precondition, though it cannot be relied on alone since the renderer must already be compromised. Permissions-policy hardening (denying camera, microphone, geolocation and notification permissions by default through enterprise policy) limits what a spoofed permission prompt can usefully trick a user into granting; the trade-off is that legitimate business applications relying on those capabilities will require explicit allow-listing. No vendor-released patch alternative exists - the fix is the version upgrade above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-862 (Missing Authorization) and sits in Chrome's Permissions subsystem, the component responsible for mediating which capabilities (camera, geolocation, notifications, and similar) a document or origin is allowed to use, and for presenting the corresponding permission prompts and indicators to the user. Because the authorization check is absent, code running inside a compromised renderer can construct permission-related UI elements that do not faithfully reflect the browser's actual permission state - a UI-spoofing primitive rather than a direct code-execution or data-exfiltration bug. Critically, the attacker must first break out of, or otherwise control, the renderer process through a separate vulnerability; the Chromium sandbox is assumed intact, and the renderer compromise is the gating precondition stated in the advisory. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is a wildcard rather than a bounded range, so the authoritative affected range comes from EUVD: Chrome versions below 155.0.8059.39 (advisory text frames it as 'prior to 155.0.8059.39'). Chromium rated the issue 'Medium' security severity, consistent with the 4.2 base score and the partial technical impact recorded by CISA SSVC.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
AC:H because a prior renderer compromise is required; PR:N per Chrome convention (renderer compromise modeled as complexity, not privilege); UI:R and low C/A for the limited UI-spoofing impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB