EUVD-2026-93858
GHSA-q77j-5pc3-78f9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process via separate flaw
-
DeliveryServe crafted HTML page
-
ExploitTrigger incorrect reference resolution in DevTools
-
ExecutionRead cross-origin/privileged data
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrectly specified target
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (a significant prerequisite, typically via a separate vulnerability), AND that a crafted HTML page is rendered in the DevTools context, AND user interaction (UI:R) is involved. These conditions substantially limit real-world exploitability: the bug is a post-compromise information-disclosure primitive rather than an initial access vector, affects Chrome versions prior to 155.0.8059.39, and is fixed in that release. The impact is confined to disclosure of sensitive information (no code execution, no integrity or availability impact). |
| Impact | This is a genuinely medium-risk, low-priority issue rather than an urgent one, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3) indicates a network-reachable bug but with high attack complexity and required user interaction, and impact limited to confidentiality (information disclosure, no integrity or availability effect). SSVC reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so the correct exploitation status is 'no public exploit identified at time of analysis.' A key caveat: the CVSS vector encodes PR:N (unauthenticated), yet the description explicitly states the attacker must have 'compromised the renderer process' first - this is a sandbox-era precondition that Google typically models through AC:H rather than PR, so the flaw is realistically a second-stage/chaining primitive, not a standalone remote hole; verify the intended threat model against the Chrome advisory. No EPSS score was supplied, so widespread-exploitation likelihood could not be weighed independently. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution within a sandboxed Chrome renderer (e.g. via a separate RCE bug) lures or already controls a tab rendering a crafted HTML page, which abuses incorrect reference resolution in DevTools to read sensitive information that should be isolated from the compromised renderer. No public exploit is known, and the high attack complexity plus required renderer compromise make this a chaining component rather than an entry point. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in Google Chrome's DevTools affects versions prior to 155.0.8059.39, where incorrect resolution of internal references can leak sensitive data to a crafted HTML page. The attack is not a standalone entry point: it requires the attacker to have already compromised the Chrome renderer process (typically through a separate bug), to have a malicious HTML page rendered in a DevTools context, and to rely on user interaction, which the CVSS vector reflects as AV:N/AC:H/PR:UnR/UI:R. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this should be handled as a routine monthly-patch item rather than an emergency.
RemediationAI
Upgrade Google Chrome to 155.0.8059.39 or later, which is the vendor-released patch for this issue (patch availability is confirmed by the vendor and the fixed build is the one named in the advisory and in the EUVD record). Enterprise deployments should push 155.0.8059.39 through their normal update channel and verify the installed version via chrome://version or the Chrome for Testing/enterprise update tooling; Chromium-based browsers should be updated once their upstream rebases onto this milestone. Because exploitation presupposes a compromised renderer, the highest-value compensating controls are the ones that make renderer compromise harder and DevTools less reachable: keep Chrome's site isolation enabled (never disable it, as it materially widens the blast radius of any renderer bug), restrict or policy-disable DevTools access for non-developer user populations via the DeveloperToolsAvailability enterprise policy, and treat any page that must be inspected in DevTools as untrusted and isolated in a throwaway profile - with the trade-off that disabling DevTools removes a primary troubleshooting tool for support staff. Enforce HTTPS and content filtering to reduce exposure to the kind of crafted HTML page required, and rely on the fact that there is no confirmed active exploitation and no public exploit code, so this does not justify out-of-band emergency change windows. The reference advisory is https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-706, Use of Incorrectly-Resolved Name or Reference, applied inside Chrome DevTools. DevTools relies on reference and name resolution when mapping front-end UI objects, panels, and inspected targets back to their underlying renderer-side counterparts; when that resolution is done incorrectly, a reference can bind to the wrong object or scope, and data that should be confined to the developer tooling becomes reachable from page-controlled content. The affected component is the Chrome browser itself (CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), and the disclosure primitive lives in the DevTools layer rather than in the renderer's memory-safety surface, which is consistent with the assigned impact profile of C:H/I:N/A:N. Because the CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U, the issue is unauthenticated from an authentication standpoint but high-complexity: the attacker must already hold renderer code execution, and the crafted HTML page must be rendered under DevTools conditions, making this a post-compromise information-disclosure primitive rather than an initial access vector. Chromium rated the underlying issue Medium, matching the independent assessment; there is no memory-corruption, code-execution, integrity, or availability angle in the available data. The corresponding EUVD record is EUVD-2026-93858 and the upstream tracking issue is Chromium issue 497350668.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Renderer-compromise precondition and crafted-page timing make AC:H; Chrome models the compromised-renderer requirement via complexity rather than PR, so PR:N with UI:R; impact is confidentiality-only.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB