EUVD-2026-93616
GHSA-f7q2-mhhh-v7v5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitInvoke WebAuthn passkey/security-key UI
-
ExecutionSpoof trusted UI elements
-
ImpactMislead user during credential interaction
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be using Google Chrome prior to 155.0.8059.39 and to be lured into loading a crafted HTML page under attacker control (UI:R); the attack specifically targets the Web Authentication (Passkeys & Security Keys) interface, so it is most relevant where users perform passkey/security-key ceremonies in the browser. No authentication or special privileges are needed on the target (PR:N), and default configurations are affected, but the hard limiting factor is mandatory user interaction and the fact that the outcome is UI spoofing rather than code execution or data theft - there is no server-side or unattended exploitation path. |
| Impact | All signals converge on LOW real-world priority despite the moderate 5.4 CVSS. The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) shows network reach and no privileges, but mandatory user interaction (UI:R) and the limited impact (only Low confidentiality and Low availability, no integrity) cap severity - consistent with Chromium's own 'Low' severity rating. No EPSS score was provided, there is no KEV listing, and no public exploit code was identified, so this is 'no public exploit identified at time of analysis.' The vulnerability is a UI-spoofing/missing-authorization (CWE-862) issue in the WebAuthn passkey flow, not memory corruption or RCE, so it does not enable code execution. Note a minor internal inconsistency: the vendor description characterizes the flaw as UI spoofing (an integrity-of-display problem), yet the supplied vector sets I:N and instead assigns A:L - the availability impact is not clearly explained by the description and should be treated cautiously. This is a high-reach-but-low-impact issue that is already patched; it is a routine-patch item, not an emergency. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page and lures a Chrome user to visit it; the page abuses the Web Authentication (Passkeys & Security Keys) flow to spoof trusted browser UI elements, potentially tricking the victim about which origin or credential is involved. No public exploit code is known, and successful exploitation requires the victim to actively load the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
UI spoofing in Google Chrome's Web Authentication (Passkeys & Security Keys) component allows remote attackers to render deceptive interface elements to users who open a crafted HTML page, because the browser fails to enforce an authorization check before displaying WebAuthn-related UI. The flaw affects Google Chrome on all platforms prior to 155.0.8059.39 and carries a moderate 5.4 CVSS score, although Chromium's own security severity rating is Low and the outcome is limited to user-interface deception rather than code execution or credential exfiltration. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the attack is only reachable through mandatory user interaction (CVSS UI:R) with no authentication or privileges required (PR:N). Google has released a patched build, and all exploitation signals converge on a low real-world priority.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later - this is the vendor-released fix and the only complete remediation; the patched build is published in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, and most installations will reach it automatically via Chrome's update service, which administrators should verify by confirming the version on chrome://version and by forcing an update (relaunching the browser applies a staged update). No workaround restores the missing authorization check, and Chrome does not expose a supported policy that disables the WebAuthn/passkey API outright - the closest operational lever, blocking or restricting the affected WebAuthn entry points through extension-level content controls or URL filtering of untrusted pages, is unreliable against a UI-spoofing primitive and carries the significant side effect of degrading or breaking passwordless sign-in and security-key MFA for users. The realistic compensating measures are therefore user-facing rather than technical: reinforce that passkey prompts should only ever be trusted when the browser chrome shows the expected origin, prioritize patching for users who routinely perform passkey or security-key ceremonies, and track downstream Chromium-based browsers (Edge, Brave, Opera) until their rebased releases incorporate the upstream fix. Enterprise fleet managers should treat this as a routine scheduled patch rather than an emergency, consistent with the Low Chromium severity rating and the absence of confirmed exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected subsystem is the browser's WebAuthn implementation - the platform API behind passkeys and hardware security keys - which relies on browser-controlled chrome (origin display, account picker, PIN/touch prompts, and related dialogs) to establish user trust during authentication ceremonies. The root cause is CWE-862 (Missing Authorization): a check that should gate the rendering or state transition of that trusted UI is absent or insufficient, so script-controlled content on a crafted page can cause the browser to present UI elements that the user would reasonably attribute to Chrome or to the authenticator rather than to the page. CVE maps to CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and is tracked by ENISA as EUVD-2026-93616; the upstream bug is public as Chromium issue 533084756. Because the issue concerns UI provenance and authorization rather than memory safety or cryptographic verification, the assessed impact is confined to low confidentiality loss and interface spoofing - the independent assessment scores C:L/I:N/A:N, meaning no integrity or availability impact was demonstrated - and the WebAuthn cryptographic ceremony itself is not described as being broken. The practical consequence is a phishing-quality deception vector aimed at users enrolling or authenticating with passkeys, where convincing browser-lookalike UI is unusually valuable to an attacker even without a direct memory-corruption primitive.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Remote crafted page with no privileges (AV:N/PR:N/AC:L) but victim must visit it (UI:R); UI spoofing yields at most minor confidentiality, and no availability impact is substantiated by the description.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB