EUVD-2026-74433
GHSA-f43h-mr75-958h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects mandatory renderer-compromise prerequisite; S:C captures the sandbox boundary escape implicit in bypassing system access restrictions.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential conditions: (1) the attacker must have already compromised the Chrome renderer process through a separate vulnerability - this is an explicit prerequisite stated in the description, not an optional condition; (2) the victim must visit a crafted HTML page (UI:R) that triggers the ServiceWorker authorization bypass. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world exploitation risk is meaningfully lower than the CVSS 6.5 base score suggests for several reasons. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 153.0.8010.36 or later; this is the vendor-released patch confirmed by the Chrome stable-channel release blog. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today