EUVD-2026-100634
GHSA-2mpf-g8rv-jrxf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process (prior exploit)
-
DeliveryLure victim to crafted HTML page via social engineering
-
ExploitTrigger missing authorization in ReadingMode
-
ExecutionBypass site isolation boundary
-
ImpactAccess cross-origin data for chain escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a chained precondition explicitly stated in the description: the attacker must FIRST have compromised the Chrome renderer process, AND must additionally succeed at social engineering to get the victim to load a crafted HTML page (reflected as UI:R). The affected feature is specifically the ReadingMode component, and the effect is bypassing Chrome's site-isolation security boundary. These prerequisites - an existing renderer compromise plus successful user interaction - are the primary limiting factors and make standalone or automated exploitation infeasible (consistent with SSVC Automatable: no, AC:H). Fixed in Chrome 155.0.8059.79 and later. |
| Impact | This is a genuinely low-priority issue despite the 'High' Chromium severity label, which reflects developer-side impact rather than real-world attacker risk. The CVSS 3.1 base score of 4.2 (AV:N/AC:H/PR:N/UI:R) aligns with multiple corroborating signals: EPSS is just 0.19% (8th percentile), there is no CISA KEV listing, and CISA's SSVC framework rates Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial'. All signals point the same direction - no exploitation pressure. The key nuance is that the CVSS vector understates the real precondition: although it encodes PR:N (no privileges), the description states the attacker must have ALREADY compromised the renderer process AND successfully leveraged social engineering. That is a substantial, multi-stage prerequisite not captured by the base metrics, which is precisely why AC:H and the limited C:L/I:L/A:N impacts were assigned. In practice this is a site-isolation-bypass sandbox-weakening primitive useful only as one link in an exploit chain, not a standalone threat. Conclusion: high-CVSS-label-but-low-real-risk; routine patch prioritization is appropriate. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution in a Chrome renderer process (e.g., via a separate renderer exploit) lures the victim to a crafted HTML page and uses the ReadingMode missing-authorization flaw to cross the site-isolation boundary. This lets data or interactions associated with one origin leak into another that should have been isolated, strengthening a broader browser-exploitation chain. No public exploit code has been identified at time of analysis, and the required pre-compromised renderer makes opportunistic mass exploitation impractical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Site isolation bypass in Google Chrome's ReadingMode component, fixed in 155.0.8059.79, lets a remote unauthenticated attacker cross a security boundary - but only after two hard preconditions are met: the renderer process must already be compromised, and the victim must be persuaded through social engineering to open a crafted HTML page. The CVSS 4.2 score (AV:N/AC:H/PR:N/UI:R) reflects that high attack complexity and required user interaction, EPSS is only 0.19% (8th percentile), SSVC records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis. This is a low real-world priority despite Chromium's 'High' severity label, which reflects developer-side impact rather than attacker risk.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.79 or later; the fix is documented in the Stable channel advisory (chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html) and in the Extended Stable advisory (chromereleases.googleblog.com/2026/10/extended-stable-update-for-desktop_0571684596.html), with the underlying engineering ticket at issues.chromium.org/issues/552510359. Chrome's auto-updater normally applies this without user action - verify the installed version at chrome://version and force an update via the browser's Help > About page if the build is stale, since the renderer-compromise precondition means unpatched endpoints are the ones worth prioritizing. Because the flaw only yields a boundary bypass after a renderer is already compromised, the most valuable compensating control is preventing that first step: keep the browser patched, restrict untrusted extensions, and block untrusted HTML content. On the isolation side, enterprise administrators can enforce the SitePerProcess and IsolateOrigins policies to harden the site-isolation boundary; the trade-off is that these are already default on desktop Chrome for most users, and forcibly expanding isolation can break sites that rely on cross-origin frames. Disabling ReadingMode outright is the most direct mitigation but costs users the reading-view feature and is a policy-level decision rather than a standards-based knob, so it should only be considered where the feature is not needed. There is no indication of active exploitation, so emergency change control is not warranted; treat this as a routine update-cycle fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) inside ReadingMode, a built-in Chrome feature that extracts and re-renders page content in a simplified reading view. Chromium's security model rests on process separation and site isolation: content is parsed in a sandboxed renderer, and the browser process enforces which origins and frames a renderer may touch. A missing authorization check in the ReadingMode path means that once an attacker already controls a compromised renderer, that renderer can drive ReadingMode to act outside the boundary it should be confined to, defeating the site-isolation assumption. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N indicates the flaw is network-reachable and requires no credentials, but succeeds only with high attack complexity and victim interaction, with low confidentiality and integrity impact and no availability impact; scope remains unchanged. Per the authoritative assessment, exploitation is a chained operation - an existing renderer compromise plus successful social engineering - which is why SSVC rates Automatable: no and Technical Impact: partial. EUVD tracks it as EUVD-2026-100634 with affected range Chrome 155.0.8059.79 < 155.0.8059.79 (i.e., builds below that release).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H and UI:R reflect the required pre-compromised renderer plus social engineering; impact limited to C:L/I:L (site-isolation bypass leaking cross-origin data) with no availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB