EUVD-2026-74385
GHSA-254r-9mcw-9755
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted HTML, no privileges, mandatory user navigation, integrity-only impact from Safebrowsing suppression, no scope change or confidentiality/availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Safebrowsing in Google Chrome prior to 153.0.8010.36 can be bypassed through improper state validation (CWE-754), enabling a remote attacker to suppress Chrome's phishing and malware protection warnings by delivering a crafted HTML page to a victim. The integrity-only impact (CVSS I:H, C:N, A:N) reflects that successful exploitation undermines Chrome's access restriction enforcement rather than directly exfiltrating data, but it clears the path for downstream malware delivery or credential harvesting that Safebrowsing would otherwise have blocked. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim user actively navigate to a specially crafted HTML page using an unpatched Chrome version prior to 153.0.8010.36; CVSS UI:R confirms passive exploitation without user navigation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a remotely exploitable flaw requiring no authentication and no special configuration - only that a user visit a crafted page - which makes mass phishing-based delivery realistic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to stable channel version 153.0.8010.36 or later; the release announcement is at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today