EUVD-2026-100644
GHSA-jmc8-532r-mf4j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun malicious local program on Windows host
-
ExploitAbuse Mojo IPC incorrect-authorization flaw
-
ExecutionEscape Chrome sandbox boundary
-
ImpactExecute arbitrary code outside sandbox
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to execute code on the target Windows host - either a malicious local program or, more typically for a Chrome sandbox escape, code already running inside a compromised sandboxed renderer - which then abuses the Mojo IPC incorrect-authorization flaw to run code outside the sandbox. Limiting factors: Windows only; only Chrome versions prior to 155.0.8059.79 are affected; local code execution (or a chained renderer compromise) is a prerequisite, and the vendor vector's UI:R implies user interaction such as visiting attacker content in the web-triggered interpretation. SSVC Automatable=no indicates it is not trivially scriptable at scale. |
| Impact | Signals conflict and must be weighed carefully. The vendor CVSS of 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) rates this Critical, but the description characterizes it as a LOCAL attacker executing code outside the sandbox 'via a local program' - a Mojo IPC sandbox-escape (CWE-863, incorrect authorization), not a straightforward remote-unauthenticated RCE. The AV:N in the vector therefore reflects Chrome's convention of scoring sandbox escapes as part of a web-triggered chain rather than true standalone network reachability; AV:N versus the 'local attacker / local program' wording is a discrepancy that should be verified with the vendor. Exploitation maturity signals are all low: SSVC Exploitation=none, no CISA KEV listing, no EPSS score provided, and no public PoC - so this is a high-severity-by-impact issue (SSVC Technical Impact=total) rather than a demonstrated, widely-exploited priority. SSVC Automatable=no is consistent with sandbox escapes, which generally require chaining with a separate renderer compromise and are not spray-and-pray. Net: patch promptly because Chrome is ubiquitous and the impact is total, but there is no evidence of active or imminent mass exploitation at time of analysis. |
| Exploit ScenarioDerived | An attacker who already has code running inside Chrome's sandbox (for example via a compromised renderer from a malicious web page) or a malicious local program on the Windows host abuses the Mojo IPC incorrect-authorization flaw to cross the sandbox boundary and execute arbitrary code in a higher-privileged context. No public exploit identified at time of analysis, so a working chain would need to be developed; realistically it would be paired with a separate renderer bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
RemediationAI
Vendor-released patch: Chrome 155.0.8059.79 - update Chrome on Windows to 155.0.8059.79 or later via the built-in updater or the stable channel advisory, then fully restart the browser and confirm the build at chrome://version (a restart is required; merely downloading the update is not sufficient). Because the prerequisite is the ability to run code on the Windows host - and, in the web-triggered interpretation, to coax the user into loading attacker-controlled content - compensating controls should target that foothold until every endpoint is patched: enforce application allowlisting to block unauthorized local binaries, keep the Windows renderer code-integrity/sandbox hardening that Chrome enables by default rather than disabling it for compatibility, and run Chrome as a non-administrative user so a sandbox escape still lands with limited privileges (trade-off: may break workflows requiring elevated browser privileges). Detection can rely on EDR monitoring for Chrome child processes spawning unexpected executables or network connections, accepting some false positives from legitimate plugins. Chromium issue 565252396 remains restricted until most users are patched, so patch-level analysis of the specific Mojo interface is not publicly available; do not substitute registry or flag tweaks as a fix, since the only complete remediation is upgrading to 155.0.8059.79 or later.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mojo is Chromium's cross-process IPC framework; Chrome's multi-process architecture relies on Mojo interfaces to let renderer, GPU, utility and other sandboxed child processes request services from the unsandboxed browser process. CWE-863 (Incorrect Authorization) means the browser-side Mojo interface handler failed to properly validate the identity or privileges of the calling process before performing a privileged action, so a caller that should not be authorized could invoke it. Because the browser process holds the user's full rights, a successfully abused interface yields code execution outside the sandbox - the classic Chrome sandbox-escape pattern where a renderer bug is chained with an IPC authorization bug. The affected component is Mojo in Chrome on Windows specifically (vendor advisory and EUVD enumerate Chrome prior to 155.0.8059.79; 155.0.8059.79 is the fixed build), and the Chromium severity rating is High. Note the vector disagreement: NVD/AI scoring uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, while the independent assessment uses AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - the latter matches the description ('local attacker... via a local program') and the SSVC Automatable=no rating, meaning the flaw is not a remotely triggerable, scriptable-at-scale issue but a local privilege boundary bypass.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Description requires a local program abusing Mojo IPC, so AV:L and PR:L; successful sandbox escape changes scope (S:C) and yields total code execution, giving C/I/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
Executive ViewAI
Google Chrome on Windows is affected by a critical privilege-boundary flaw that can let an attacker with an existing local foothold or a compromised browser renderer escape the sandbox and execute code with the browser's privileges. This is not remotely exploitable through a web page alone, and no public exploit identified at time of analysis, but broad Chrome deployment means unpatched Windows endpoints increase post-compromise risk to browser sessions, credentials, and enterprise data. Leadership should prioritize rapid patching and verification across the Windows fleet.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB