EUVD-2026-74399
GHSA-h6hj-vh5q-r86j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML requiring user navigation; no privileges needed; confidentiality-only impact with no integrity or availability effects documented.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: the victim must be running Google Chrome on Windows (not Linux, macOS, or other platforms), Chrome must be operating in an Enterprise deployment context with the affected Enterprise feature active, and the victim must navigate to an attacker-controlled or compromised HTML page (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score reflects a network-exploitable, zero-privilege information disclosure requiring user interaction, with high confidentiality impact but no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Google Chrome to version 153.0.8010.36 or later as documented in the Google stable channel release advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today