EUVD-2026-65801
GHSA-pmxj-692w-95v8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the mandatory renderer compromise precondition absent from the vendor vector; all other metrics align with the description and vendor scoring.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential preconditions: first, the attacker must have already compromised the Chrome renderer process via a separate, independent vulnerability - this is not a standalone exploit path; second, the target user must render or visit a crafted HTML page (user interaction required, UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.3 score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) encodes a medium-severity network-reachable flaw requiring user interaction, with limited confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targeting a specific user first exploits a separate renderer-level vulnerability - such as a V8 JavaScript engine bug - to compromise the Chrome renderer process, then serves a crafted HTML page that exercises the Extensions subsystem authorization flaw to break web origin isolation and read content from a privileged browser-internal page. No public exploit code for CVE-2026-79174 has been identified; successful exploitation requires chaining at least two distinct Chrome vulnerabilities. |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later; this is the vendor-confirmed fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today