EUVD-2026-66071
GHSA-r8p4-w8m3-48gf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim via social engineering
-
DeliveryVictim installs crafted Chrome extension
-
ExploitExtension triggers off-by-one in DevTools
-
ExecutionOut-of-bounds read of sandbox memory
-
ImpactExfiltrate leaked memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Off-by-one prevention
|
| Exploitation Conditions | Exploitation requires the victim to install an attacker-supplied crafted Chrome extension - the description explicitly states 'leveraging social engineering' via 'a crafted Chrome extension,' so successful user interaction to install that extension is the concrete prerequisite. Limiting factors: the attack fails against users on 152.0.7977.65 or later; it fails where extension installation is blocked or allowlisted by policy; the disclosed memory is confined to inside the sandbox (no escape, no code execution, no write primitive); and it depends on tricking the user, so it is not a silent drive-by. This makes realistic risk far lower than the raw 9.1 suggests. |
| Impact | Real-world risk is low despite the inflated 9.1 score in the input. The signals conflict and must be reconciled: the supplied CVSS:3.1 vector claims C:H/I:H/A:N (network, no privileges, no user interaction), but the description explicitly requires social engineering to get a victim to install a crafted extension and describes only a memory read inside the sandbox - there is no integrity impact and the confidentiality impact is bounded, so the 9.1 is not credible. Chromium itself rates this Low. Corroborating low-risk signals: EPSS 0.16% (6th percentile), no KEV listing, no public POC, and SSVC exploitation status 'none'. The one elevated SSVC signal, Technical Impact 'total' with Automatable 'yes', sits awkwardly against a Low-severity sandbox-internal read and should be treated with skepticism. Net: this is a high-CVSS-but-low-real-risk item - patch it in the normal Chrome auto-update cycle rather than as an emergency. |
| Exploit ScenarioDerived | An attacker publishes or distributes a malicious Chrome extension and uses social engineering (a lure page, fake tool, or sideloading instructions) to persuade a victim to install it. Once running, the extension triggers the off-by-one in DevTools to read one element beyond a buffer boundary, leaking small amounts of adjacent renderer memory that could contain sensitive data. No public exploit code has been identified, and the read stays within the sandbox. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Information disclosure in Google Chrome's DevTools (versions prior to 152.0.7977.65) lets a remote attacker who convinces a user to install a crafted Chrome extension read adjacent memory inside the renderer sandbox via an off-by-one error. Chromium rates the security severity as Low, and there is no public exploit identified at time of analysis; SSVC lists exploitation status as none and EPSS is negligible (0.16%, 6th percentile).
RemediationAI
Vendor-released patch: update Google Chrome to 152.0.7977.65 or later via the Stable channel (see the Chrome release advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html). Most installations receive this automatically; enterprises managing Chrome via policy should confirm auto-update is enabled and verify the deployed build number, restarting the browser to apply the update. As compensating controls until the update lands, restrict extension installation using enterprise policy (ExtensionInstallBlocklist set to '*' with an ExtensionInstallAllowlist of vetted IDs, or ExtensionInstallForcelist to pin approved extensions) - the trade-off is that users lose the ability to install arbitrary extensions, which is precisely the exploitation prerequisite here, so the control is well-matched to the risk. Given the Low severity and lack of exploitation, emergency action is not warranted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an off-by-one error (CWE-193) in Chrome's DevTools component, the built-in debugging surface reachable by extensions through the DevTools/debugger APIs. An off-by-one typically arises from an incorrect boundary check (e.g., using <= instead of < or miscounting a buffer length), causing a one-element out-of-bounds access. Here it results in an out-of-bounds read that discloses memory contents but remains bounded within the renderer sandbox rather than achieving a sandbox escape. The affected product per CPE is cpe:2.3:a:google:chrome (all versions below the fixed build). Because the read is confined to the sandbox, impact is limited to information disclosure rather than code execution or sandbox breakout.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires social-engineering the user into installing a crafted extension (UI:R); impact is a bounded sandbox-internal memory read (C:L only), with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially read memory inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)
Executive ViewAI
A critical vulnerability in Google Chrome (CVE-2026-79148, CVSS 9.1) could enable attackers to steal employee credentials and data through malicious browser extensions. While no public exploit has been identified and a vendor patch is available, organizations should prioritize rapid patching and enforce extension installation policies to minimize data theft risk.
Apply vendor patch. Until fully deployed, restrict browser extension installations to administrator-approved sources via Chrome policies and disable user-initiated extension installations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-193 – Off-by-one Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB