EUVD-2026-93702
GHSA-43mh-78jh-546v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process via separate bug
-
DeliveryServe crafted HTML page
-
ExploitTrigger missing FileSystem authorization check
-
ExecutionBypass web origin policy
-
ImpactRead cross-origin data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process (a non-trivial prerequisite normally obtained via a separate vulnerability), after which a crafted HTML page abuses the FileSystem component's missing authorization check (CWE-862) to cross the web origin boundary. User interaction is required (UI:R) - the victim must load attacker-controlled content. This is strictly a chain/second-stage flaw: against a default, fully-patched Chrome with an intact renderer sandbox it is not directly exploitable, which materially limits real-world risk despite the network attack vector. Impact is confined to cross-origin data disclosure (high confidentiality, low integrity, no availability impact). |
| Impact | This is a second-stage browser vulnerability whose real-world risk is moderate despite the 8.2 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) scores it high primarily due to the changed scope (S:C) and high confidentiality impact from a cross-origin read, but the PR:N rating is misleading when read against the description: exploitation explicitly requires 'a remote attacker who had compromised the renderer process.' That prerequisite is not reflected in the CVSS privileges metric, so the network/no-privilege scoring overstates standalone exploitability - this flaw is only useful as a link in an exploit chain, not as a primary entry point. Supporting signals align with lower real-world urgency: EPSS is 0.22% (12th percentile), it is NOT listed in CISA KEV, no public exploit code is referenced, and Google/Chromium itself rated the security severity only Medium. No signals conflict with each other; rather, the quantitative severity (CVSS 8.2) conflicts with the contextual severity (Medium, low EPSS, chain-dependent). Net assessment: a genuine security fix worth patching on normal Chrome auto-update cadence, but not an emergency relative to directly-exploitable renderer RCEs. Verify the chain assumption with the vendor - the CVSS PR:N does not capture the compromised-renderer precondition stated in the description. |
| Exploit ScenarioDerived | An attacker first achieves code execution inside Chrome's sandboxed renderer process (typically via a separate memory-corruption bug), then serves a crafted HTML page that abuses the FileSystem authorization gap to read data belonging to other web origins, defeating the same-origin policy. No public exploit code is identified for this specific issue, and the attack is only practical as the second stage of a multi-bug chain rather than a standalone drive-by. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Cross-origin data disclosure in Google Chrome (all versions prior to 155.0.8059.39) stems from a missing authorization check in the browser's FileSystem component, allowing a crafted HTML page to breach the web origin boundary and read data it should not reach. Exploitation is strictly a second-stage condition: an attacker must first have already compromised Chrome's renderer process through a separate flaw, and the victim must load attacker-controlled content (UI:R), so a default, fully patched Chrome with an intact renderer sandbox is not directly exploitable - a limitation that makes real-world risk moderate despite the 8.2 base score, and is reflected in the low EPSS of 0.22% (12th percentile). Google has shipped a fix in Chrome 155.0.8059.39, there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later via chrome://settings/help (or the enterprise MSI/PKG/DEB/RPM channel) and fully restart the browser so the new binary loads; extended-release and managed fleets should be moved to the patched build on an accelerated schedule. No pre-patch workaround fully closes the gap, and there is no known public exploit to hunt for, so prioritization should be driven by the fact that this is a second-stage flaw: the strongest compensating control is preventing the renderer compromise it depends on - keep the renderer sandbox and Site Isolation enabled (disabling Site Isolation for performance or compatibility materially increases exposure here), and patch other Chrome renderer vulnerabilities promptly. Organizations willing to accept compatibility breakage can reduce the attack surface of attacker-supplied pages by using Chrome enterprise policies to block the File System Access API for untrusted origins (for example setting DefaultFileSystemReadGuardSetting and DefaultFileSystemWriteGuardSetting to block plus FileSystemReadBlockedForUrls/FileSystemWriteBlockedForUrls), but note the trade-off: this can break legitimate web applications that rely on file access and may not cover every internal file path used by the browser, so it is a hardening measure and not a substitute for the 155.0.8059.39 update. Full technical background is in the Chromium issue tracker at https://issues.chromium.org/issues/510773353 and the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-862 (Missing Authorization) defect inside Chrome's FileSystem implementation - the component that backs the File System Access API and the Origin Private File System used by the renderer to obtain file and directory handles. A security check that should validate whether a renderer-driven file/URL request is authorized to act on a given origin is absent, so a compromised renderer can invoke privileged browser-side file operations across the origin boundary, breaking the same-origin policy. Architecturally this is a trust-boundary failure between the untrusted renderer and the more privileged browser process (communicating over Mojo IPC); the missing check means the browser process grants file-handle access without verifying the requesting origin's entitlement. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms broad applicability to the Chrome product line prior to the fixed release. Our independent reassessment differs from the published NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) by rating attack complexity as High rather than Low, because the renderer must already be under attacker control - normally achieved only via a second, independent vulnerability - before this bug becomes reachable. Scope is Changed (S:C) with high confidentiality impact and low integrity impact and no availability impact, consistent with a cross-origin read/leak primitive rather than memory corruption.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
AC:H because exploitation depends on a prior renderer compromise outside the attacker's direct control; S:C and C:H reflect the cross-origin disclosure; A:N as availability is unaffected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 are affected by a high-severity cross-origin data disclosure issue that can expose sensitive web data only after a separate renderer compromise and user interaction. Because exploitation is second-stage and not directly viable against a hardened, sandboxed browser, the immediate likelihood is moderate, but unpatched Chrome fleets still represent a confidentiality risk if attackers achieve an initial renderer foothold. Leadership should care because Chrome is widely deployed and the vendor fix is available, making rapid version verification and update a straightforward risk-reduction priority; no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB