EUVD-2026-65868
GHSA-gq66-w869-w9pw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network vector and no-privilege access are appropriate; UI:R is confirmed by the need for victim browser interaction; confidentiality impact is limited to cross-origin data leakage with no integrity or availability consequence.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
AnalysisAI
Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be running Google Chrome prior to version 152.0.7977.65 on any supported platform. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score reflects a meaningful but constrained threat profile: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) and no integrity or availability impact (I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update Google Chrome to version 152.0.7977.65 or later, as confirmed by the vendor stable channel update at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today