EUVD-2026-93845
GHSA-8f8x-mm7h-vhqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled page
-
ExploitServe crafted HTML triggering Media path
-
ExecutionRead uninitialized memory in Media component
-
ImpactExfiltrate leaked cross-origin data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted HTML page in a vulnerable Chrome build prior to 155.0.8059.39 (UI:R - user interaction via navigation/visit). No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected since the vulnerable Media code path is standard browser functionality. The limiting factors are: the requirement for user interaction (the victim must be induced to visit the page), the confidentiality-only impact (attacker gains disclosed cross-origin data, not code execution or system control), and the need for the user to be running an unpatched version. There is no special non-default feature or configuration prerequisite indicated in the description. |
| Impact | This is a genuine but moderate-priority issue, not a critical one. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects limited impact: confidentiality-only (C:L), no integrity or availability effect, and required user interaction (UI:R) - the victim must be lured to a malicious page. All signals point the same way and are consistent: CISA SSVC lists Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which aligns with the low confidentiality impact. There is no CISA KEV listing and no EPSS score was supplied, and no public exploit was identified at time of analysis. Google rated the underlying Chromium bug 'High' severity internally, which exceeds the NVD-style 4.3 base score; this is a common and expected divergence - Google's rating weighs the class of bug (cross-origin data disclosure in the Media component) and sandbox implications, while the CVSS base vector weighs the constrained, interaction-gated real-world impact. No key data is outright conflicting, though the absence of an EPSS probability limits quantitative exploitation forecasting. Net: patch in the normal browser-update cycle rather than treating as an emergency. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a victim to open it in a vulnerable Chrome build (via phishing link, malvertising, or a compromised site). When the page is rendered, a Media component code path reads uninitialized memory, leaking data that belongs to another origin back to attacker-controlled script, breaking the same-origin policy. No public exploit code was identified at time of analysis, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Information disclosure in Google Chrome versions prior to 155.0.8059.39 allows a remote, unauthenticated attacker who convinces a victim to open a crafted HTML page to read data belonging to other origins, bypassing the browser's same-origin boundary. Exploitation requires user interaction (UI:R) but no privileges, and default Chrome installations are exposed because the vulnerable Media code path is standard browser functionality; the impact is confidentiality-only, consistent with a CVSS base score of 4.3. No public exploit code has been identified at time of analysis and CISA's SSVC records no known exploitation, so the practical risk is concentrated in unpatched endpoints rather than active attacks; Google has shipped a fixed build.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later, per the stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html; most installations receive this automatically through the built-in updater, but administrators should verify chrome://version and restart the browser to complete the update, since the fix only takes effect after a full restart. There is no supported configuration toggle that disables the Media component without breaking normal audio/video playback, and Site Isolation - already enabled by default on modern Chrome - only partially constrains cross-origin leakage, so patching remains the only reliable control. Where immediate updating is impossible, restricting browsing to trusted sites and blocking untrusted HTML attachments at mail and web gateways reduces the attack surface, with the trade-off of disrupting legitimate content; this is a compensating measure, not a substitute for the update. Confirm that any Chromium-derived browser in the environment has adopted an equivalent 155.0.8059.39-or-later build before considering it remediated, and monitor https://issues.chromium.org/issues/567379988 for any change in status.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-908 (Use of Uninitialized Resource) in Chrome's Media component, which handles audio/video parsing and playback within the renderer. When a crafted HTML page drives the Media code path into a state where a memory buffer or resource is consumed before it is initialized, the resulting disclosure can return bytes that belong to another origin's data rather than to the attacker's page, effectively leaking across the same-origin boundary. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N describes a network-reachable, low-complexity issue that needs no authentication (PR:N) but does require the victim to visit the malicious page (UI:R), with scope unchanged and only partial confidentiality loss (C:L) and no integrity or availability impact. The CPE entry cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms that all Chrome builds below the fixed release are in scope, and Google's Chromium team rated the underlying defect High even though the CVSS base score is moderate. Because it is a renderer-side memory-disclosure bug constrained by user interaction and limited to data leakage, it should not be conflated with remote code execution or with an active exploitation campaign.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page with no auth gives AV:N/AC:L/PR:N, but the victim must visit the page so UI:R; impact is limited cross-origin data disclosure, hence C:L and I:N/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB