EUVD-2026-105527
GHSA-64p2-vr57-j8wq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
DeliveryLure victim to visit in Chrome
-
ExploitAbuse ComputePressure access control flaw
-
ExecutionBypass web origin policy
-
ImpactAccess cross-origin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-controlled crafted HTML page in a vulnerable Google Chrome build prior to 156.0.8078.47 (CVSS UI:R - user interaction is mandatory, limiting mass automation), after which no authentication is needed (PR:N). The flaw is specific to the ComputePressure API's access-control handling; environments where the targeted Chrome version is already updated are not affected. The available sources do not state whether any non-default flag or configuration is required to reach the vulnerable code path. |
| Impact | Signals conflict on this one and that gap matters. NVD assigns CVSS 8.8 (High) from the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, yet Google's own Chromium team rated the issue only Medium severity, and the flaw itself is an improper-access-control / web-origin-policy bypass in the ComputePressure API (CWE-284) rather than remote code execution - a C:H/I:H/A:H impact profile is hard to reconcile with a sensor-API origin bypass, so the NVD base score likely overstates real-world impact. EPSS is low at 0.24% (14th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced (the issues.chromium.org link is a bug-tracker entry, typically access-restricted, not a PoC). Exploitation also requires user interaction (UI:R) - the victim must open a crafted page. Net: this is a legitimate browser fix worth deploying on the vendor's 'this_week' cadence, but the combination of low EPSS, no KEV, no PoC, and a Medium vendor rating indicates it is not an emergency and the 8.8 should be treated with skepticism pending the exact impact detail, which the sources do not describe. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page and lures a victim running a vulnerable Chrome build (before 156.0.8078.47) to open it; when the page abuses the ComputePressure API's improper access control, it bypasses the web origin policy and can reach information or behavior that should be isolated to another origin. No public exploit code is identified at time of analysis, and the precise trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Improper access control in Google Chrome's ComputePressure component allows a remote, unauthenticated attacker to bypass web origin policy in any build prior to 156.0.8078.47 by getting a victim to open a crafted HTML page. Impact scoring conflicts across sources: the published vector claims 8.8 with high confidentiality and integrity impact, while our own assessment rates it confidentiality-only and low (C:L/I:N/A:N), so the realistic worst case is a limited cross-origin information leak rather than full compromise. No public exploit code has been identified at time of analysis and EPSS sits at 0.24% (14th percentile); the mandatory user interaction keeps mass automation unlikely, which is why it is prioritized for remediation this week rather than treated as an emergency.
RemediationAI
Vendor-released patch: 156.0.8078.47 - upgrade Google Chrome to that stable-channel build or later, as documented in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html) and tracked in https://issues.chromium.org/issues/502710681. The supplied sources describe no workaround or configuration-level mitigation, so the stable-channel update is the only complete fix identified; the mandatory user interaction (UI:R) means exposure is limited to sessions where a user actually loads an attacker-supplied page, so the practical interim measure is to shorten the window between advisory publication and fleet-wide rollout, prioritizing any Chromium-derived browsers built from pre-156.0.8078.47 snapshots. Where centralized update management is in place, verify the reported browser build string against 156.0.8078.47 rather than relying on update-check success, since partial rollouts of the stable channel are common in the first days of a release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is ComputePressure, the Chromium implementation of the Compute Pressure API, which exposes coarse CPU/pressure state observations to JavaScript running in a web page. Access to that signal is meant to be gated by web origin policy (cross-origin isolation, permissions policy and the per-origin exposure rules that govern which documents may observe the pressure state), so that unrelated origins cannot use the readings as a cross-origin side channel. The flaw is classified as CWE-284 (Improper Access Control), meaning the enforcement of those origin restrictions - not memory corruption or a logic bug in pressure sampling itself - is what fails, allowing a crafted HTML page to reach pressure data its origin should not be entitled to. The supplied sources do not state the precise triggering sequence, nor whether any non-default flag, origin-trial enrolment or configuration is required to reach the vulnerable code path; they confirm only that builds before 156.0.8078.47 are affected and that exploitation needs the victim to load an attacker-controlled page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with required user interaction (UI:R); an origin-policy bypass in a sensor API and Google's Medium rating imply limited confidentiality leakage, not integrity or availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome's ComputePressure component contains an access control flaw (CVE-2026-113057) that could allow an attacker to bypass web origin policy, potentially exposing limited cross-origin information to malicious pages. While the CVSS base score of 8.8 suggests high severity, our internal analysis indicates a more limited confidentiality impact with no integrity or availability loss. Given the mandatory user interaction and absence of known exploitation, this poses a moderate risk to the organization's browser fleet but warrants prompt patching to close the exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB