EUVD-2026-105658
GHSA-hc84-w8gp-cw8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitAbuse DevTools improper access control
-
ImpactLeak sensitive information to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to actively load an attacker-controlled crafted HTML page in a vulnerable Google Chrome build (any version prior to 156.0.8078.47) - this mandatory user interaction (UI:R) is the primary limiting factor. No authentication or prior privileges are needed (PR:N), and no special non-default browser configuration is indicated; the DevTools improper access control is the exploited surface. Exploitation is bounded to leaking sensitive information (no integrity or availability impact), and is fully mitigated by updating to 156.0.8078.47 or later. |
| Impact | This is a Medium-severity (CVSS 6.5) improper access control flaw (CWE-284) in Google Chrome's DevTools that leaks sensitive information. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N shows a network-reachable, low-complexity, unauthenticated attack that requires user interaction (the victim must visit a crafted HTML page) and yields high confidentiality impact with no integrity or availability impact - consistent with an information-disclosure bug rather than code execution. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is indicated, so exploitation signals are currently absent/unknown. Chromium's own rating of Medium aligns with the mandatory user-interaction requirement and the read-only (no I/A) impact, which lowers real-world urgency relative to a critical RCE. Net: this is a patch-on-normal-cadence issue for most, elevated only by Chrome's ubiquity - not a drop-everything priority. Note a data inconsistency: the input Tags label this 'Authentication Bypass,' but the description and CWE-284 describe improper access control causing an information leak, not an authentication bypass - the tag appears mislabeled. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page and lures a Chrome user (via phishing link, malvertising, or a compromised site) into visiting it. The crafted HTML abuses the improper access control in DevTools to read and exfiltrate sensitive information from the browser context. No public exploit is identified at time of analysis, and the attack cannot proceed without the victim opening the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper access control in the DevTools component of Google Chrome builds earlier than 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page leak sensitive information from the browser; no credentials or elevated privileges are required, but the attack hinges on the victim actively loading the attacker's page. The flaw is rated Medium (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N) with confidentiality-only impact, and Google has released a fixed build (156.0.8078.47). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the issues.chromium.org tracker remains access-restricted, limiting technical detail.
RemediationAI
Upgrade Google Chrome to 156.0.8078.47 or later - this is the vendor-released patch and fully mitigates the issue; deploy via the standard update channel, verify the version in chrome://version, and track fleet compliance since Chrome's silent auto-update can lag on managed endpoints. Confirm rollout against the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html, and apply the equivalent Chromium fix to any embedded or downstream Chromium-based browsers. Where immediate upgrade is not possible, compensating controls are limited and carry trade-offs: restrict DevTools availability via the DeveloperToolsAvailability enterprise policy (blocks the exposed tooling but breaks legitimate developer and support workflows and may not cover all attack paths), and reduce the attack surface by blocking untrusted HTML content and enforcing safe-browsing/proxy filtering (partial mitigation only, breakage risk for legitimate web use). Because exploitation requires the victim to load an attacker-crafted page, user awareness and blocking of untrusted links offer marginal defense, but patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-284 (Improper Access Control), located in Chrome's DevTools subsystem - the developer tooling surface that exposes page internals, network activity, and privileged diagnostics to the browser UI and to attached debugging clients. A breakdown in access-control checks on that surface permits an attacker-controlled HTML page to induce leakage of sensitive information across a boundary that should be enforced (confidentiality impact is High, with no integrity or availability effect). The attack is network-delivered (AV:N) and low-complexity (AC:L) but requires user interaction (UI:R) and no privileges (PR:N), yielding the unchanged-scope score of 6.5. Because DevTools restrictions can differ between release channels and enterprise-managed configurations, exposure depends on the exact Chrome build and policy state; CPE/version data places affected deployments below 156.0.8078.47, and the Chromium issue 562041808 is restricted, so the precise violated check is not publicly documented.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Delivered via a crafted web page so AV:N/AC:L/PR:N, but the victim must open the page (UI:R); read-only information leak means C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB