EUVD-2026-93733
GHSA-5p54-r239-gw5w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
ExploitDeliver crafted HTML + social engineering
-
ExecutionTrigger OOB read in printing
-
ImpactLeak memory outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (this is a sandbox-boundary leak used post-renderer-compromise, not an initial foothold), PLUS social engineering to get the victim to load a crafted HTML page that exercises the Printing code path, on Google Chrome for Windows prior to 155.0.8059.39. Limiting factors: the prerequisite renderer compromise makes this a chained/second-stage bug; user interaction (UI:R) is required; it is Windows-specific; and impact is confined to reading memory (confidentiality only, C:L) with no code execution, integrity, or availability effect on its own. |
| Impact | This is a genuinely low-priority issue despite being a sandbox-boundary information leak. Multiple signals agree: CVSS is only 4.7 (Medium), EPSS is 0.18% (6th percentile) indicating very low probability of near-term exploitation, there is no CISA KEV listing, and no public exploit code was identified. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) technically shows network vector with no privileges required, but this CONFLICTS with the description, which states the attacker must have 'already compromised the renderer process' before leveraging this bug - a substantial precondition that Chrome's scoring convention folds into the attack model rather than into PR. In other words, PR:N overstates ease of access: in practice this is the second stage of a multi-bug chain, not a standalone remote attack. The S:C (scope change) correctly reflects that the flaw reads memory outside the renderer sandbox, but impact is limited to a partial confidentiality leak (C:L, no integrity/availability impact). Net: a real but low-urgency defense-in-depth fix, valuable mainly as one link in an exploit chain rather than a widespread threat. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution in the Chrome renderer (via a separate bug) lures a user with a crafted HTML page that drives the printing code path, triggering an out-of-bounds read that discloses memory from outside the sandbox. This would be used as a chained information-disclosure primitive (e.g., to defeat ASLR or leak secrets) rather than as an initial access vector. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Out-of-bounds memory read in Google Chrome's Printing component on Windows (all versions prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to read memory outside the sandbox when a victim is socially engineered into loading a crafted HTML page. The flaw is rated Chromium security severity Medium and carries a CVSS v3.1 base score of 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), reflecting a scope-changing confidentiality-only leak with no integrity or availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (6th percentile), and a vendor patch is available.
RemediationAI
Vendor-released patch: upgrade Google Chrome for Windows to 155.0.8059.39 or later, delivered through the stable channel update at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; end users can force the update via chrome://settings/help and restart, and managed fleets should push the version through Google Update or enterprise policy and verify the reported version. Because exploitation requires a previously compromised renderer plus user interaction on a crafted HTML page, the highest-value compensating controls target the prerequisite rather than this bug itself: keep Strict Site Isolation enabled (it is default but can be overridden by policy, and disabling it materially raises renderer-compromise risk), restrict navigation to untrusted HTML through URL filtering or proxy policy (trade-off: blocks legitimate content and needs ongoing allow-list maintenance), and disable or restrict printing via enterprise policy such as PrintingEnabled=0 where printing is not required (trade-off: removes a business function and does not eliminate the vulnerable code path if a renderer is already compromised). Prompt patching of renderer-level vulnerabilities across the Chrome fleet should be prioritized, since this issue is only exploitable as a chained second stage. No vendor-published workaround specific to this defect is identified in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an out-of-bounds read (CWE-125) in Chrome's Printing subsystem, which handles print preview and page rendering/generation for print output on Windows. Because the printing pipeline spans the renderer and privileged browser-process code, a memory-safety defect there can cross the Chrome sandbox boundary - this is why the assessed vector uses S:C (scope changed) and credits the attack as a sandbox-boundary leak rather than a same-origin bug. The root cause class is a bounds-checking failure when parsing or processing attacker-influenced input through the Printing code path, resulting in reads beyond an allocated buffer. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome builds before the fixed Windows release are in scope, and EUVD (EUVD-2026-93733) likewise lists Chrome < 155.0.8059.39. Critically, this is not an initial-access primitive: the CVSS vector AV:N/AC:L/PR:N/UI:R describes the network-reachable, user-interaction-driven trigger, but the practical prerequisite is that the attacker already controls a compromised renderer - making this a second-stage, chained bug whose value depends on a separate renderer exploit. Impact is confined to reading process memory (C:L) with no demonstrated write primitive, code execution, or denial of service.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Web-delivered so AV:N/PR:N by Chrome convention, UI:R for the social-engineering lure, S:C because the read crosses the sandbox boundary, and C:L only - a partial memory disclosure with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB