EUVD-2026-65851
GHSA-4gfx-v2gw-qrh8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), user must visit it (UI:R), no attacker privileges needed (PR:N), impact limited to partial confidentiality read with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim actively navigate to a crafted HTML page - user interaction is mandatory and confirmed by UI:R in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating a network-reachable flaw requiring no attacker privileges and low attack complexity, but constrained by a mandatory user interaction (UI:R) and a limited confidentiality impact with no integrity or availability consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page on an attacker-controlled domain and delivers its URL to a target via phishing, malvertising, or social engineering. When the victim navigates to the page in an unpatched Chrome browser, the malicious page exploits the authorization flaw in the Navigation subsystem to read limited data from a cross-origin context - for example, inferring user session state or partial content from a same-browser tab or frame. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later, which resolves this flaw per the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today