EUVD-2026-74396
GHSA-mjjr-x3qf-v4rg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page, no auth required, user must visit page (UI:R); only partial confidentiality impact, unchanged scope, no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
CSS output encoding failure in Google Chrome prior to 153.0.8010.36 allows an unauthenticated remote attacker to potentially bypass the same-origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin information disclosure. The CVSS score of 4.3 aligns with Chromium's own 'Medium' severity classification, reflecting that the impact is scoped to partial confidentiality loss with no integrity or availability consequence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must actively visit a crafted HTML page in an unpatched Chrome browser (UI:R); no action beyond page load is required once the user navigates to the attacker-controlled URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a moderate-severity finding: network-reachable, trivial to attempt, no authentication required, but gated on a user visiting a malicious page and producing only partial confidentiality impact within an unchanged scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 153.0.8010.36 or later, available via Chrome's built-in auto-update mechanism or manually through the stable channel release at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allShare
External POC / Exploit Code
Leaving vuln.today