EUVD-2026-105653
GHSA-x64j-72pg-mmw8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitLoad malicious JavaScript into V8
-
ExecutionBypass web origin policy
-
ImpactAccess cross-origin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or visit an attacker-controlled crafted HTML page in an unpatched Google Chrome build prior to 156.0.8078.47 (UI:R / user interaction is the primary limiting factor). No authentication or elevated privileges are required (PR:N), and no non-default configuration is indicated - the flaw is in V8, Chrome's default JavaScript engine. The specific V8 code path and how the improper access control is triggered are not described in the available sources. The chief defender-relevant limiter is that the attack is not fully automatic: a user must be induced to load malicious web content, which bounds mass-scale, unattended exploitation. |
| Impact | Signals conflict and net out to moderate, not emergency, priority. The NVD/Google CVSS 3.1 base score is 8.8 (High) with AV:N/AC:L/PR:N/UI:R, but Google's own Chromium security team rated this only 'Medium' severity, and the C:H/I:H/A:H impact metrics are Chrome's standard conservative scoring for renderer bugs rather than a demonstrated full-impact outcome - the practical effect described is a web origin (same-origin policy) bypass, which is primarily a cross-origin data-disclosure issue. Exploitation likelihood signals are low: EPSS is 0.23% (14th percentile), the CVE is NOT on CISA KEV, and no public exploit or working PoC is identified in the input (the chromium issue-tracker link is a typically-restricted bug reference, not exploit code). The vuln.today decision label is 'this_week', consistent with a patch-promptly posture rather than act_now/emergency. The one amplifying factor is prevalence - Chrome is ubiquitous and attackers routinely weaponize V8 bugs - so this warrants timely patching, but current data does not indicate active or imminent widespread exploitation. Note the explicit discrepancy: CVSS High (8.8) vs. vendor Medium severity and low EPSS - treat the 8.8 as an upper-bound severity, not a statement of exploitation probability. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing JavaScript that triggers the improper access control in V8; when a victim using an unpatched Chrome (before 156.0.8078.47) visits the page, the same-origin/web-origin policy is bypassed, letting the attacker's script access data or resources belonging to other web origins the victim has access to. Exploitation requires the victim to visit the page (UI:R) but no authentication or special privileges. No public exploit or working PoC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Improper access control in the V8 JavaScript engine of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially bypass web origin policy, compromising the confidentiality and integrity of data across origins. Exploitation needs no credentials (PR:N) but does require user interaction, so unattended mass exploitation is bounded. No public exploit code or CISA KEV entry is present in the supplied data; EPSS is low at 0.23% (14th percentile), and the priority decision is this_week rather than emergency.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later, the vendor-released fixed build documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html; Chrome's own updater typically delivers this automatically, but enterprise fleets should verify the reported version via chrome://version or their management console. Chromium-based browsers not covered by Google's update channel should track the fix through https://issues.chromium.org/issues/561660149. No standalone workaround is described in the supplied sources beyond running the patched build, so the practical compensating control is reducing exposure - restricting browsing to trusted destinations and enforcing prompt update compliance - while accepting that this does not remove the underlying V8 access-control weakness.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-284 improper access control defect inside V8, Chrome's default JavaScript and WebAssembly engine, which is the component that enforces much of the isolation between browsing contexts and origins in coordination with Blink. A breakdown of access control at this layer is significant because origin policy is the browser's fundamental security boundary for the same-origin model, cookies, DOM access and script isolation. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity issue requiring user interaction only, with high confidentiality and integrity impact and no availability impact in our assessed vector (C:H/I:L/A:N). The trigger relies on a victim visiting an attacker-controlled crafted HTML page in an unpatched build; the exact V8 code path and the precise mechanism by which the access-control check is subverted are not described in the available sources. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the entire Chrome release family below the fixed build is in scope, with no non-default configuration indicated as a prerequisite.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth (AV:N/PR:N) but needs the victim to visit it (UI:R); an origin-policy bypass chiefly exposes cross-origin data (C:H) with limited integrity and no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions before 156.0.8078.47 contain a high-severity access control flaw in the V8 JavaScript engine that could allow a malicious webpage to bypass web origin policy, potentially compromising cross-origin data confidentiality and integrity. While no public exploit or confirmed active exploitation exists, the required user interaction (visiting a crafted page) still poses a risk to employees browsing the web, and leadership should prioritize timely patching to maintain defense-in-depth against future exploit development.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB