EUVD-2026-66078
GHSA-wgvg-mhg6-5x7r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network attacker requires only victim page visit (UI:R, PR:N, AC:L); impact is pure confidentiality loss with no integrity or availability effect (I:N, A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Incorrect authorization in the Forms component of Google Chrome prior to version 152.0.7977.65 enables a remote unauthenticated attacker to obtain sensitive browser-held form data by directing a victim to a crafted HTML page. The CVSS 6.5 score reflects high confidentiality impact (C:H) with no integrity or availability consequence, consistent with a pure information disclosure primitive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim running Google Chrome prior to 152.0.7977.65 to visit an attacker-controlled or attacker-influenced HTML page - confirmed by the CVSS UI:R (user interaction required) metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N presents a network-reachable, low-complexity flaw requiring only a single user click or navigation event - a realistic social engineering threshold. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page and distributes its URL via phishing email or malicious advertisement, targeting Chrome users on vulnerable versions prior to 152.0.7977.65. When the victim navigates to the page, JavaScript or HTML form constructs exploit the incorrect authorization check in Chrome's Forms component to read sensitive data - such as autofilled credentials or previously entered form values - and exfiltrate it to an attacker-controlled server. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, which is the vendor-released patch documented at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today