EUVD-2026-66064
GHSA-hf32-gfvw-q74r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Origin policy bypass typically permits some data access (C:L) in addition to the High integrity impact; UI:R and PR:N are grounded in the social-engineering extension-install prerequisite with no authentication to a target system required.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)
AnalysisAI
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim be running Google Chrome prior to version 152.0.7977.65 AND be socially engineered into installing a specifically crafted malicious Chrome extension - this is the explicit attack precondition stated in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures a network-reachable, low-complexity attack with a high integrity impact, but the UI:R metric is critical: exploitation requires the victim to be socially engineered into installing a malicious Chrome extension, substantially reducing opportunistic exploitation likelihood. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Google Chrome to version 152.0.7977.65 or later, the patched stable release documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today