EUVD-2026-93622
GHSA-r8qr-v34r-jm34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page
-
DeliveryLure victim via social engineering
-
ExploitVictim opens page in Chrome on Mac
-
ExecutionExploit improper UI privilege management
-
ImpactBypass system access restrictions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on macOS at a version prior to 155.0.8059.39, and requires active user interaction: the target must be socially engineered into visiting and interacting with an attacker-crafted HTML page (consistent with UI:R in the CVSS vector). No authentication is required (PR:N) and no special Chrome configuration is named in the advisory, but the mandatory user-interaction and social-engineering prerequisite is the primary limiting factor - the flaw cannot be triggered silently or server-side. Platform is limited to macOS; other Chrome platforms are not listed as affected. |
| Impact | This is a low-priority issue despite a moderate CVSS 5.4. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates network reach with low complexity and no privileges, but mandatory user interaction (UI:R) and the description's reliance on social engineering materially constrain real-world exploitability. All exploitation signals point the same direction: EPSS is very low at 0.18% (7th percentile), SSVC assigns Exploitation:none and Automatable:no with only partial technical impact, there is no CISA KEV listing, and no public POC was identified. Google/Chromium itself rated the security severity Low. The signals are consistent rather than conflicting - there is no high-CVSS-but-hidden-risk tension here, nor a low-EPSS-despite-KEV anomaly. The combination of required user interaction, low/partial impact (C:L/I:L/A:N), and no evidence of exploitation makes this a routine patch-on-cycle item rather than an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page and uses social engineering (e.g., a phishing link or lure) to convince a macOS Chrome user to visit it. When the victim interacts with the page, flawed privilege management in the browser UI lets the page bypass intended system access restrictions, yielding limited confidentiality and integrity impact. No public exploit code was identified at time of analysis, and the attack cannot succeed without victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Improper privilege management in the Chrome UI on macOS allows a remote attacker to bypass system access restrictions by socially engineering a victim into visiting and interacting with a crafted HTML page. Only Chrome for macOS builds prior to 155.0.8059.39 are affected; no authentication is required (PR:N), but the attack cannot succeed without the victim actively engaging with the malicious page (UI:R). Google rates the Chromium security severity as Low, EPSS is just 0.18% (7th percentile), SSVC records no exploitation and no automatable path, and no public exploit code has been identified at the time of analysis. Impact is limited to partial confidentiality and integrity loss with no availability effect.
RemediationAI
Vendor-released patch: upgrade Google Chrome on macOS to version 155.0.8059.39 or later via the built-in Update Google Chrome mechanism (chrome://settings/help) or by downloading the current stable build from the Chrome release channels; the fix and release details are documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html. Keeping Chrome auto-update enabled is the most reliable control, since this is a macOS-only UI privilege-handling issue and no server-side or enterprise-policy toggle is named in the advisory to disable the affected surface. Because exploitation depends on social engineering that leads a user to a crafted HTML page (UI:R), interim risk reduction should focus on user-side controls: enforce browser-level protections such as Google Safe Browsing, deploy DNS/URL filtering or web proxy blocklists for untrusted sites, restrict macOS user accounts to standard (non-administrator) privileges so a UI privilege bypass yields less system access, and reinforce phishing/social-engineering awareness. Note the trade-offs - URL filtering and Safe Browsing can produce false positives against legitimate sites and do not stop all crafted pages, and limiting accounts to standard users may break workflows that require local administrative rights; none of these compensating controls replaces patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-269 (Improper Privilege Management) and resides in the Chrome user-interface layer on macOS. Rather than a memory-safety bug, this is a flaw in how the macOS build of Chrome mediates privilege boundaries surfaced through its UI, allowing a crafted HTML page combined with social engineering to circumvent system access restrictions. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N confirms the attack is network-delivered, needs no credentials, and is scoped to the vulnerable component with only low confidentiality and integrity consequences and no availability impact - consistent with the CISA SSVC assessment of 'partial' technical impact and 'Automatable: no'. The only CPE provided, cpe:2.3:a:google:chrome, is unversioned, so exact affected builds must be taken from the vendor advisory and EUVD data, which specify Chrome versions below 155.0.8059.39; the macOS platform restriction is a key scoping factor, as other Chrome platforms are not listed as affected. The associated Chromium issue tracker entry (issues.chromium.org/issues/540078886) is referenced in the vendor advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Delivered over the network via a crafted page (AV:N) with no privileges (PR:N) but mandatory victim interaction (UI:R); improper privilege management yields limited confidentiality and integrity impact (C:L/I:L) and no availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB