EUVD-2026-65993
Incomplete Cleanup (CWE-459)
GHSA-6xc6-gr29-x5mg
5.3
CVSS 3.1 · Vendor: Chrome
Share
Severity by source
Vendor (Chrome)
PRIMARY
5.3
MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today
AI
5.3
MEDIUM
AV:N and UI:R for web-delivered social engineering; AC:H for mandatory renderer-compromise prerequisite; C:H for sensitive media data exposure; no integrity or availability impact.
3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Lifecycle Timeline
4
Analysis Generated
Aug 26, 2026 - 19:36 vuln.today
CVSS changed
Aug 26, 2026 - 19:23 NVD
5.3 (MEDIUM)
CVE Published
Aug 25, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 25, 2026 - 20:10 cve.org
MEDIUM 5.3
DescriptionCVE.org
Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Compromise Chrome renderer via separate vuln
Delivery
Serve crafted HTML page to target
Exploit
Social-engineer user to grant media permissions
Execution
Trigger GetUserMedia incomplete cleanup
Persist
Read residual sensitive media data from renderer memory
Impact
Exfiltrate information to attacker
Access
Compromise Chrome renderer via separate vuln
Delivery
Serve crafted HTML page to target
Exploit
Social-engineer user to grant media permissions
Execution
Trigger GetUserMedia incomplete cleanup
Persist
Read residual sensitive media data from renderer memory
Impact
Exfiltrate information to attacker
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two cumulative prerequisites: (1) the attacker must have already achieved code execution within the Chrome renderer process, likely through a separate, preceding vulnerability - this is a high-complexity chained attack, not a standalone exploit; and (2) the attacker must successfully social-engineer the target user into visiting or interacting with a crafted HTML page, satisfying the UI:R requirement in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) accurately captures the tension between high confidentiality impact and the exceptional prerequisite barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already gained code execution within a Chrome renderer process - for example through a separate, chained renderer bug - serves a crafted HTML page that invokes the GetUserMedia API and then triggers the incomplete cleanup path. By socially engineering the target user into interacting with the page (e.g., granting camera or microphone permission via a fake video-call prompt), the attacker causes Chrome to leave sensitive media buffer data or stream state accessible in the renderer's memory. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later - this is the vendor-released patch per the stable channel update advisory at chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).