EUVD-2026-65790
GHSA-xjcv-37r2-c8w8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise prerequisite; C:L for limited cross-origin read; I:N and A:N match the description's scope.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two stacked prerequisites: (1) the attacker must have already achieved renderer process compromise via a separate Chrome vulnerability - this flaw is not self-contained and cannot be exploited in isolation; and (2) the victim must visit (UI:R) a crafted HTML page controlled by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable, limited-impact flaw requiring user interaction, but it does not fully capture the critical prerequisite stated in the description: the attacker must have independently compromised the Chrome renderer process before this vulnerability is exploitable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first leverages a separate, independently exploitable Chrome renderer vulnerability to achieve renderer process compromise - for example, a memory corruption flaw in a content parsing component - and then serves the victim a crafted HTML page that triggers the incorrect authorization check in the Transactions Platform, causing Chrome to allow cross-origin resource access that should be blocked by the web origin policy. No public exploit code has been identified for this specific flaw, and the chained requirement (renderer compromise plus user page visit) makes opportunistic mass exploitation unlikely under current conditions. |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today