EUVD-2026-74473
GHSA-738x-v3c2-2wpw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Social engineering yields UI:R; no scope change (not a sandbox escape); CORS policy bypass produces only low integrity impact with no confidentiality or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
AnalysisAI
CORS origin-policy bypass in Google Chrome before 153.0.8010.36 allows a remote attacker, via social engineering and crafted network traffic, to circumvent the browser's web origin policy due to improper certificate validation in the CORS implementation (CWE-295). The impact is constrained to low-integrity effects - Chrome may treat cross-origin requests as authorized when they should be rejected - with no confidentiality or availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires social engineering to induce the victim user to visit an attacker-controlled page or interact with crafted network traffic (CVSS UI:R - passive interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 Medium score is consistent with Chromium's own 'Low' severity rating, and the EPSS score of 0.18% at the 7th percentile confirms very low exploitation probability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 153.0.8010.36 or later using the browser's built-in update mechanism (Help > About Google Chrome) or by deploying the update via enterprise management tooling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-295 – Improper Certificate Validation
View allShare
External POC / Exploit Code
Leaving vuln.today