EUVD-2026-65870
GHSA-x59q-wjwf-gr37
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-exploitable via crafted traffic requiring user interaction; impact is limited to partial confidentiality disclosure with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
AnalysisAI
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 and active user interaction with web content (UI:R per CVSS vector), meaning the victim must be actively browsing rather than passively connected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects a moderate-severity finding: network-reachable, low complexity, no privileges required, but constrained by mandatory user interaction and limited to partial confidentiality impact with no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Google Chrome to version 152.0.7977.65 or later, the patched stable channel release documented at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today