EUVD-2026-74474
GHSA-vmwr-6hc4-r546
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (Chrome) · only source for this CVE.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: Low)
AnalysisAI
Improper certificate validation in Chrome's Federated Credential Management (FedCM) component — fixed in Chrome 153.0.8010.36 — lets a remote attacker who controls crafted network traffic, combined with social engineering of the victim, bypass web origin policy and expose cross-origin identity data. The flaw is a confidentiality-only issue (no integrity or availability impact) and Chrome rates it security severity Low, despite a 7.5 CVSS base score; EPSS is only 0.15% (4th percentile), it is not in CISA KEV, and no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today