EUVD-2026-93766
GHSA-q8xv-cf94-x426
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim via social engineering
-
ExploitServe crafted HTML page
-
ExecutionBypass WebProtect authorization check
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to be socially engineered into opening an attacker-controlled crafted HTML page in Google Chrome (UI:R); exploitation is not drive-by and cannot occur without this user action. No authentication is required (PR:N) and no special non-default Chrome configuration is indicated - the WebProtect authorization check is triggered against a standard Chrome install prior to 155.0.8059.39. The primary limiting factor is the mandatory user interaction/social-engineering step, which substantially reduces realistic exploitability compared with a zero-click network attack. |
| Impact | Signals are mixed and warrant scrutiny. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, unauthenticated flaw requiring only user interaction - which on paper looks severe. However, the vendor (Chromium) rates this only 'Medium', and the description scopes the impact strictly to 'obtain sensitive information' via a crafted HTML page, i.e. a confidentiality/authorization issue. This is a direct conflict: the vector's I:H and A:H (full integrity and availability loss) are not supported by the description, which implies information disclosure only. My independent assessment (C:H/I:N/A:N) yields ~6.5 Medium, consistent with the vendor rating, suggesting the 8.8 is inflated. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Because exploitation depends on social engineering (UI:R) rather than a drive-by, real-world risk is moderate: patch promptly via normal browser update cadence, but this is not an emergency-priority, mass-exploitable bug. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page and uses social engineering (e.g. a phishing link or lure) to convince a Chrome user to open it. When the victim visits, the incorrect-authorization flaw in WebProtect is triggered, allowing the attacker's page to access sensitive information it should not be authorized to read. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Incorrect authorization in Google Chrome's WebProtect component lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page read sensitive information held in the browser context - the assessed impact is confidentiality-only (C:H/I:N/A:N), with no integrity or availability loss. Every Chrome build prior to 155.0.8059.39 is affected across platforms, and Google rates the underlying issue as Chromium security severity Medium. Exploitation is not drive-by: the CVSS vector requires user interaction (UI:R) and PR:N, so no credentials or non-default configuration are needed but the victim must be lured to the attacker-controlled page, and no public exploit code has been identified at time of analysis, making the base score of 8.8 an overstatement of realistic risk.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later; this is the only complete remediation because WebProtect is an integrated browser component rather than a toggleable feature, so no user- or policy-level disable fully removes the flawed authorization path. Confirm the installed build via chrome://version and rely on Chrome's auto-update, or push the fixed build through enterprise software deployment if auto-update is restricted; release details are at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the fix is tracked in https://issues.chromium.org/issues/553139506. Until every endpoint is on 155.0.8059.39, compensating controls are necessarily partial and should be treated as risk reduction rather than prevention: enforce URL/domain filtering and block uncategorized or newly registered domains to blunt the social-engineering lure (trade-off: false positives on legitimate sites and ongoing allowlist maintenance), disable or tightly restrict untrusted browser extensions and side-loaded content that could deliver the crafted page (trade-off: reduced user productivity), and reinforce phishing awareness since the exploit cannot fire without a victim click. Because the flaw affects confidentiality only, data-classification controls and monitoring for anomalous outbound requests from browser processes can help detect post-exploitation data access, but none of these measures substitutes for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863 (Incorrect Authorization): Chrome's WebProtect component performs an authorization decision that can be satisfied or bypassed by content originating from a crafted HTML page, so a check that should restrict which data the page can reach is evaluated incorrectly. Unlike memory-corruption bugs, this is a logic/access-control defect - no memory safety primitive is required, only the ability to deliver attacker-controlled markup that reaches the WebProtect code path. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the EUVD range "Chrome 155.0.8059.39 <155.0.8059.39" indicates the entire stable channel before 155.0.8059.39 is in scope, and the fix is tracked upstream in Chromium issue 553139506. The presence of UI:R in both the vendor and independent vectors is the defining technical constraint: the authorization flaw is only reachable after the user navigates to attacker-supplied content, which is why this is classified as a social-engineering-assisted information disclosure rather than a zero-click browser compromise.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page with no auth but mandatory user interaction (AV:N/PR:N/UI:R); description supports only sensitive-information disclosure, so C:H with I:N/A:N, unlike the input's inflated I:H/A:H.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome versions prior to 155.0.8059.39 contain an incorrect authorization flaw that could allow a remote, unauthenticated attacker to read sensitive information from the browser context if a user is socially engineered into opening a crafted HTML page. This affects all employees using unpatched Chrome, potentially exposing confidential data such as session tokens or personal information. While exploitation requires user interaction, no public exploit identified at time of analysis, and the impact is confidentiality-only, the broad deployment of Chrome and the potential for data leakage warrant immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB