EUVD-2026-74340
GHSA-84hr-v5jv-xw58
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network vector with high complexity reflects required on-path MITM positioning; C:H for potential cleartext credential capture; no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: Medium)
AnalysisAI
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to occupy a network-on-path position relative to the victim (e.g., same LAN, rogue AP, or ISP-level MITM), making this an opportunistic rather than remote mass-exploitation scenario. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a meaningful but practically constrained threat: confidentiality impact is high if exploitation succeeds, but AC:H means the attacker must occupy a network-adjacent or on-path position to intercept and manipulate traffic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update Google Chrome on iOS to version 153.0.8010.36 or later via the Apple App Store. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today