EUVD-2026-74376
GHSA-wmjj-p562-vggx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted page; social engineering mandates UI:R; no confidentiality or availability loss, only integrity bypass via cleanup failure within unchanged scope.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires active user interaction - the victim must visit a crafted HTML page, and social engineering is the explicitly stated delivery mechanism (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) captures the core trade-off well: while network delivery and low complexity keep the attacker's bar low, the mandatory user interaction (UI:R via social engineering) is a meaningful friction point that limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Google Chrome to version 153.0.8010.36 or later; this is confirmed as the vendor-released patch per the Chrome Releases stable channel advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-459 – Incomplete Cleanup
View allShare
External POC / Exploit Code
Leaving vuln.today