EUVD-2026-63596
GHSA-p594-q3qj-x3q3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
AC:H applied because the description requires a pre-compromised renderer as a precondition, a materially higher bar than the official AC:L reflects.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Workers in Google Chrome prior to 151.0.7922.173 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Incorrect authorization in Chrome's Workers implementation allows a remote attacker to bypass the web origin policy and gain unauthorized access to cross-origin data and resources. Exploitation requires a chained attack: the attacker must first compromise the Chrome renderer process through a separate vulnerability, then use social engineering to get the victim to interact with a crafted HTML page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two explicit preconditions must both be met for exploitation: (1) the attacker must have already achieved code execution within the Chrome renderer process via a separate, independent vulnerability - this is stated directly in the CVE description and is the primary limiting factor; (2) the attacker must successfully social-engineer the victim into interacting with a crafted HTML page (UI:R), typically via phishing or malicious content delivery. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) overstates exploitability in real-world conditions because it scores the authorization bypass in isolation, not the full prerequisite chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already leveraged a separate renderer memory-corruption vulnerability to gain code execution within Chrome's renderer sandbox crafts a malicious HTML page embedding a Web Worker script designed to exfiltrate session tokens or modify data from a victim's authenticated origin (e.g., an internal corporate web app). The attacker delivers this page via a phishing email or malicious ad, and upon the victim clicking a link or button (satisfying the social engineering requirement), the Worker executes, bypasses the origin boundary check, and reads or writes cross-origin resources without triggering the normal SOP block. … |
| Remediation | Upgrade Google Chrome to version 151.0.7922.173 or later, as released in the August 2026 Stable Channel update documented at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0404570826.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Chrome installations across the organization and prepare deployment of Chrome 151.0.7922.173 through your standard patch management process. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today