EUVD-2026-66073
GHSA-29r4-vj43-cgm9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Description explicitly states 'local attacker' and 'crafted file,' placing AV:L; C:H reflects full password credential exposure with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file. (Chromium security severity: Low)
AnalysisAI
The Passwords (built-in credential manager) component of Google Chrome on iOS prior to version 152.0.7977.65 leaks sensitive password data to a local attacker who can supply a crafted file, enabling unauthorized retrieval of stored credentials. Only the iOS platform is affected, and the Chromium security team rates this as Low severity internally. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to an iOS device running Google Chrome prior to version 152.0.7977.65, with the Chrome Passwords (built-in credential manager) feature in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R) conflicts with the description's explicit 'local attacker' characterization - a local attack surface does not align with AV:N, and this discrepancy meaningfully affects the base score calculation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local access to an iOS device - through device sharing, theft, or co-located malware with filesystem access - places a crafted file in a location accessible to the Chrome Passwords component. When the Passwords subsystem processes or interacts with this file, it leaks stored credential data that the attacker can then read. … |
| Remediation | Update Google Chrome on iOS to version 152.0.7977.65 or later; this is the vendor-released patch confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today