EUVD-2026-93621
GHSA-5564-w272-r5vf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger incorrect authorization in PermissionElement
-
ImpactBypass system access restrictions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to use a vulnerable Google Chrome desktop version prior to 155.0.8059.39 AND to actively visit or load an attacker-crafted HTML page (UI:R) that abuses the PermissionElement component's incorrect authorization check. There is no authentication requirement on the attacker side (PR:N), but the mandatory user interaction, the dependence on reaching the specific PermissionElement permission-handling code path, and the limited Low-severity technical impact (no availability impact, only partial confidentiality/integrity) materially constrain real-world exploitability to opportunistic drive-by scenarios rather than scalable automated attacks. |
| Impact | Multiple signals converge on this being a genuinely low-priority issue despite a medium CVSS of 5.4. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows network reach and no privileges required, but is gated by required user interaction and limited to Low confidentiality and integrity impact with no availability impact - consistent with Google's own 'Chromium security severity: Low' rating. EPSS reinforces this at just 0.18% (7th percentile), and CISA's SSVC decision framework independently agrees: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis. The signals are therefore mutually consistent rather than conflicting - a real but low-urgency browser flaw. The one nuance worth noting: although AV:N marks this 'network', the practical delivery is web-page-based requiring a victim to visit attacker content, so this is opportunistic/drive-by in nature, not a server-side remotely-reachable service bug. No key data is contradictory, though the specific 'system access restrictions' being bypassed are not fully detailed in the description. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that abuses the incorrect authorization in Chrome's PermissionElement to bypass permission-related access restrictions. A victim running a vulnerable Chrome version (prior to 155.0.8059.39) is lured into visiting the page, and the crafted content triggers the flaw to improperly gain access the user did not intend to grant. No public exploit code is identified at time of analysis, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Incorrect authorization in Google Chrome's PermissionElement component, affecting desktop builds prior to 155.0.8059.39, allows a remote attacker to bypass system access restrictions by enticing a user to load a crafted HTML page. The attacker needs no credentials and no prior access (CVSS:3.1/AV:N/AC:L/PR:N), but successful exploitation depends on the victim actively visiting or rendering the malicious page (UI:R) and on reaching the specific permission-handling code path, so impact is confined to partial confidentiality and integrity loss with no availability impact. Risk is low in practice: EPSS is 0.18% (7th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and Chromium itself rates the issue Low severity despite the 5.4 base score; vendor-released patches are available in version 155.0.8059.39.
RemediationAI
Primary fix: upgrade Google Chrome to 155.0.8059.39 or later; the patch is vendor-released and available now, so rely on the built-in updater (chrome://settings/help) or an enterprise software-deployment mechanism, then confirm the running version at chrome://version and fully restart the browser, since the update only takes effect for processes started afterwards. The official release note describing the fix is at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, with technical detail in the Chromium tracker at https://issues.chromium.org/issues/540076586; because this shipped as a Chromium security fix, also update any Chromium-derived browsers in your fleet to their equivalent patched milestones. If immediate fleet-wide upgrade is not possible, compensating controls are limited and carry trade-offs: enforce automatic updates and block or delay launch of unpatched Chrome builds via your endpoint-management or application-control tooling (breaks users who legitimately depend on pinned browser versions, and version pinning is often needed for internal web apps); restrict high-value users to a hardened, allowlisted browsing profile or a remote-rendering/VDI browser where only trusted sites are reachable (reduces drive-by exposure but degrades general web usability); and, where your Chrome enterprise policy set permits it, disable or restrict the standardized permission-request UI and related permission prompts so the PermissionElement code path is not reachable (effective at cutting the attack surface but causes legitimate sites to fall back to less friendly permission prompts, and policy names must be verified against your Chrome version's policy template before deployment). Given EPSS of 0.18%, no KEV listing and no public exploit identified, mitigation can proceed on a normal patch-cycle cadence rather than emergency response, but the update should still be applied promptly because the attack requires nothing more than a crafted page and a single user visit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an authorization-check defect (CWE-863: Incorrect Authorization) in Chromium's PermissionElement, the browser-side component that backs standardized, embeddable permission-request UI (the proposed HTML <permission> element used so sites can offer a browser-controlled prompt for permissions such as camera, microphone, or geolocation instead of rolling their own). Because the component is meant to be the trusted gatekeeper for permission state, any weakness in how it validates the requesting context means a crafted page can cause the element to be treated as authorized when it should not be, letting the page reach capabilities that the browser's access restrictions should have denied. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N vector shows this is remotely reachable with low attack complexity and no attacker authentication, but it is user-interaction dependent and its scope is unchanged, with only low confidentiality and integrity impact and no availability impact - consistent with CISA SSVC's 'partial' technical impact and 'none' for exploitation and automatable. The affected product scope is the Google Chrome stable channel (CPE pattern cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), with the fix landing in the 155.0.8059.39 release; EUVD tracks the same single vulnerable range, Chrome < 155.0.8059.39.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Delivered via a crafted web page so AV:N/PR:N but UI:R for the victim visit; impact limited to a permission bypass, giving C:L/I:L/A:N and S:U.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB