EUVD-2026-34671
GHSA-c359-w8jq-qfwq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted RAR file. (Chromium security severity: Medium)
AnalysisAI
Safe Browsing bypass in Google Chrome prior to 149.0.7827.53 allows a remote attacker to circumvent discretionary access control protections by delivering a specially crafted RAR file to a victim who interacts with it. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication or elevated privileges are required on the attacker side, but exploitation depends on user interaction - the victim must engage with the malicious RAR file. The integrity impact is rated High (I:H) with no confidentiality or availability impact, indicating the primary risk is bypassing file-based access controls enforced by the Safe Browsing subsystem. No public exploit identified at time of analysis, and EPSS at 0.02% (4th percentile) reflects very low observed exploitation probability.
Technical ContextAI
The vulnerability resides in Chrome's Safe Browsing subsystem, a security layer designed to warn users about or block potentially dangerous files, URLs, and downloads. CWE-284 (Improper Access Control) identifies the root cause as a failure to correctly enforce access control decisions - specifically, an 'inappropriate implementation' in how Safe Browsing processes or evaluates RAR archive files. RAR archives are container formats that can embed arbitrary content; a crafted RAR may exploit parsing edge cases, malformed headers, or nested structures to confuse the Safe Browsing engine into issuing an incorrect allow decision where it should block. Affected versions are confirmed as all Chrome releases prior to 149.0.7827.53 per the ENISA EUVD entry (EUVD-2026-34671) and the Google stable channel advisory.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later; this is the vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy and confirm the version through chrome://settings/help. As a compensating control prior to patching, organizations may consider blocking RAR file downloads at the email gateway or web proxy layer - note this may disrupt legitimate use of compressed archives. Enabling Enhanced Safe Browsing mode in Chrome (Settings > Privacy and security > Security > Enhanced protection) may provide additional heuristic coverage, though it is not confirmed to mitigate this specific bypass. Do not rely on Safe Browsing alone as a file-vetting control until patched; pair with endpoint detection tools that inspect archive contents independently of Chrome.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today