EUVD-2026-69738
GHSA-mhxr-ggrg-5qcc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Social engineering forces UI:R; dependence on a specific co-installed app raises AC:H; network-delivered content keeps AV:N and PR:N, with high system-access impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
6DescriptionCVE.org
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)
AnalysisAI
Access-restriction bypass in Google Chrome desktop prior to 152.0.7977.75 lets a remote attacker who first tricks a user via social engineering leverage a co-installed application to escape Chrome's system access boundaries. The flaw is an improper input validation (CWE-20) issue in the browser's DataTransfer component, rated High by Chromium and fixed in the September 2026 Stable channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites drawn from the description: (1) successful social engineering of the victim - the user must be induced to take an action, so this is effectively user-interaction-dependent, not silent; and (2) a specific co-installed application on the host through which the DataTransfer data is channeled to bypass system access restrictions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Google Chrome 152.0.7977.75 - update to this or later via the Stable channel and relaunch the browser to apply it (Chrome auto-updates but requires a restart to complete; verify under chrome://settings/help). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running Chrome versions prior to 152.0.7977.75 and review patch deployment readiness. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today