EUVD-2026-93688
GHSA-jwjr-7j35-xrmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
ExploitLure victim to open page in Chrome
-
ExecutionTrigger information leak in Enterprise component
-
ImpactExfiltrate leaked sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load attacker-controlled crafted HTML in Google Chrome versions prior to 155.0.8059.39 (UI:R, confirmed by CVSS vector) - there is no zero-click path. No authentication is required (PR:N). The flaw resides in Chrome's Enterprise component; the description does not state whether a specific enterprise policy or managed-configuration mode must be active, so whether default consumer installs are equally affected is not confirmed from available data. The limiting factors are mandatory user interaction (opening a malicious page) and the fact that impact is confined to disclosure of sensitive information (C:L), with no integrity or availability effect. |
| Impact | This is a genuinely low-to-moderate priority issue despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) scores 4.3 (Medium), and Chromium itself rates the security severity as Medium. All exploitation signals are weak: CISA's SSVC decision framework records Exploitation as 'none', Automatable as 'no', and Technical Impact as 'partial', which aligns with the low confidentiality-only impact (C:L, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is not evidence of active exploitation. The requirement for user interaction (UI:R - the victim must open a crafted HTML page) materially lowers real-world risk compared to a drive-by zero-click flaw. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are consistent with one another (medium severity, no automatable exploitation, partial/limited impact) rather than conflicting - this reads as a routine browser information-disclosure bug to be remediated through normal Chrome patch cadence, not an emergency. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing specially crafted HTML and lures a Chrome user (prior to 155.0.8059.39) into visiting it, for example via a phishing link or a malicious ad. When the page loads, a flaw in the Enterprise component leaks sensitive information back to the attacker. No public exploit code is identified at time of analysis, and the attack cannot succeed without the victim opening the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Information disclosure in the Enterprise component of Google Chrome allows a remote attacker to leak sensitive information from affected browsers when a victim opens a crafted HTML page. Only Chrome versions prior to 155.0.8059.39 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms a network-reachable, unauthenticated attack that nonetheless requires the user to actively load attacker-controlled content, so there is no zero-click path and the impact is limited to confidentiality with no integrity or availability effect. CISA's SSVC assessment records no known exploitation and no automatable vector, and no public exploit has been identified at time of analysis; the issue is rated Chromium security severity Medium and is addressed by the vendor's stable channel update.
RemediationAI
Vendor-released patch: update Google Chrome to 155.0.8059.39 or later, distributed through the stable channel update described in the Chrome release notes at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html. Standard practice is to let the browser's built-in auto-update apply the build and then verify the version in chrome://settings/help (or via the deployed package version), because browser relaunches are required before the patched binary is active; fleets managed by enterprise policy should pin or push the new version immediately. Where patching cannot be completed at once, the practical compensating controls are to restrict browsing to trusted sites and block untrusted or uncategorized domains through enterprise URL filtering, and to run high-risk browsing inside an isolated or throwaway profile - the trade-off being reduced user flexibility and additional administrative overhead, while neither measure eliminates the flaw itself. Because exploitation requires the victim to load a crafted page (UI:R), user awareness of suspicious links and HTML attachments provides only marginal additional reduction of exposure, and disabling JavaScript or the HTML rendering path broadly is not a realistic mitigation given the operational disruption it would cause.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and sits in Chrome's Enterprise component, the code path that handles enterprise policies, managed configuration and related browser functionality. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) indicates the affected package is the Google Chrome browser itself rather than a separate server-side product, and the EUVD affected-version record confirms remediation at 155.0.8059.39. The attack surface is the browser's HTML rendering and Enterprise-integration code: an attacker supplies a crafted HTML page that, once rendered by the victim, causes information to be disclosed that should be protected. Because the vector is PR:N/UI:R, no credentials are needed but the victim must navigate to the malicious page, and because the metrics are C:L/I:N/A:N the exposure is bounded to partial confidentiality loss. The description does not state whether a specific enterprise policy or managed-configuration mode must be active, so whether default consumer installs are equally affected cannot be confirmed from available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to open it (UI:R); only limited information disclosure, so C:L and I/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB