EUVD-2026-69743
GHSA-2cvv-4hfg-3c48
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Renderer compromise prerequisite justifies AC:H; spoofing falsifies displayed URL warranting I:L over I:N; no meaningful availability impact from address-bar deception alone.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
5DescriptionCVE.org
Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two hard prerequisites: (1) the attacker must have already achieved code execution within the Chrome renderer process via a separate, independent vulnerability, and (2) user interaction with a crafted HTML page is required (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.2 score (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) correctly encodes the high attack complexity imposed by the mandatory renderer compromise prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 152.0.7977.75 or later, which is the vendor-released fix announced in the September 2026 stable channel update at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today