EUVD-2026-66053
GHSA-45j2-j98w-743q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer process
-
DeliveryServe crafted HTML page
-
ExploitBypass Passwords authorization check
-
ExecutionRender spoofed UI elements
-
ImpactDeceive victim into disclosing credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (explicitly stated in the description) - this is the primary limiting factor and means the bug is not independently exploitable against a default, fully-patched browser. Given that foothold, the attacker delivers a crafted HTML page to trigger the missing-authorization UI spoof in the Passwords component. Limiting factors: the renderer-compromise prerequisite, the low-severity UI-spoofing-only impact (no direct code execution or data exfiltration from this bug alone), and the need for the victim to be deceived by the spoofed UI. Note the NVD vector's PR:N/UI:N contradicts the described precondition and should not be read as 'no prerequisites.' |
| Impact | The signals conflict sharply and should be reconciled before prioritization. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H) yields 9.1 Critical, but this contradicts both the description - which requires the attacker to have already compromised the renderer process, a significant prerequisite - and Chromium's own 'Low' severity rating; the true impact is UI spoofing, not high confidentiality/integrity loss, so PR:N and C:H/I:H appear inflated (verify with vendor). Supporting a lower real-world priority: EPSS is only 0.23% (14th percentile), the issue is not on CISA KEV, and no public POC is referenced. Realistically this is a chained, post-renderer-compromise UI-deception weakness rather than a standalone critical remote flaw, so even a mid-sized municipal IT team should patch on the normal Chrome auto-update cadence rather than treat it as an emergency. Bottom line: high CVSS number, low genuine risk. |
| Exploit ScenarioDerived | An attacker first exploits a separate vulnerability to gain control of a Chrome renderer process, then serves a crafted HTML page that abuses the missing authorization check to render spoofed Passwords/browser UI elements. The victim, trusting the forged interface, is induced to enter or disclose credentials. No public POC is referenced, and the attack is only viable as a follow-on to an existing renderer compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
UI spoofing in Google Chrome's Passwords component (versions prior to 152.0.7977.65) lets a remote attacker who has already compromised the renderer process present forged interface elements via a crafted HTML page, enabling deception such as credential phishing. Chromium rated this severity Low, and no public exploit or active exploitation has been identified; EPSS is low at 0.23% (14th percentile). The headline NVD CVSS of 9.1 substantially overstates the practical impact given the required renderer compromise.
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Google Chrome to 152.0.7977.65 or later via the Stable channel (Settings > About Chrome triggers the update, then relaunch); reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. Most consumer installs auto-update, so ensure background updates and the relaunch are not being suppressed by policy. In managed fleets, push the pinned version through your update-management tooling and verify enforcement. No official workaround is published; because exploitation presupposes a compromised renderer, the most effective compensating control is keeping the sandbox and site isolation intact and applying all concurrent Chrome security fixes that address renderer-compromise bugs - with the trade-off that this only reduces, not eliminates, the precondition. Downstream Chromium browsers should be updated once their vendors incorporate this Chromium release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing authorization (CWE-862) in Chrome's Passwords subsystem, the component that manages saved credentials and the password manager UI within the browser. Chrome uses a multi-process architecture where untrusted web content runs in sandboxed renderer processes isolated from the privileged browser process; here the absence of an authorization check allows a controlled renderer to influence or spoof trusted UI surfaces associated with Passwords. The affected product per CPE is cpe:2.3:a:google:chrome (all versions before the fix). Root cause is an access-control gap rather than memory corruption, so exploitation manipulates trust/authorization boundaries in the UI rather than achieving direct code execution.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires prior renderer compromise (AC:H) and victim viewing the spoofed UI (UI:R); impact is limited UI spoofing/deception, so C:N/I:L/A:N - far below the inflated NVD 9.1.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome versions prior to 152.0.7977.65 contain a UI spoofing vulnerability in the Passwords component that could enable attackers to present forged credential interface elements for phishing. No public exploit has been identified at time of analysis; exploitation requires the attacker to have already compromised the Chrome renderer process, significantly limiting real-world attack surface. Organizations should prioritize updating Chrome to protect users from potential credential compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB