EUVD-2026-65983
GHSA-9h87-hgp7-299f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page, no privileges needed, user interaction required, scope unchanged, limited read-only cross-origin leak with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively visit or be redirected to an attacker-controlled crafted HTML page (CVSS UI:R - user interaction is mandatory and non-negotiable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 (Medium) score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable, low-complexity flaw with no required privileges, but mandatory user interaction and limited, contained confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious HTML page that abuses a flaw in Chrome's StreamsAPI implementation to read resources from a privileged browser page (such as a chrome:// internal page) loaded in the same browser session. The victim is socially engineered - via phishing, malvertising, or a compromised site - into visiting the crafted page, triggering the cross-origin policy bypass and leaking limited data back to the attacker. … |
| Remediation | Upgrade Google Chrome to version 152.0.7977.65 or later, as documented in the Google stable channel release advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today