EUVD-2026-93860
GHSA-pjpm-89p5-m432
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim via social engineering
-
ExploitVictim opens crafted HTML page
-
ExecutionTrigger incorrect reference resolution in browser
-
ImpactLeak sensitive information to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrectly specified target
|
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on macOS at a version prior to 155.0.8059.39 AND to actively open attacker-supplied content: the attacker must use social engineering to get the user to visit or load a specially crafted HTML page (UI:R). There is no authentication requirement (PR:N) and the attack is network-delivered (AV:N), but the mandatory user interaction and macOS-specific scope are the key limiting factors that reduce realistic risk; users on non-macOS platforms or already updated to 155.0.8059.39+ are not affected. |
| Impact | Signals conflict sharply here and that materially lowers the real priority below what the headline 8.8 implies. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) claims full high impact on confidentiality, integrity AND availability, but both the description ('allowed a remote attacker ... to obtain sensitive information') and Google's own 'Chromium security severity: Medium' rating describe an information-disclosure-only bug with no integrity or availability impact - the 8.8 appears to be an inflated or boilerplate third-party score rather than Google's assessment. Exploitation also requires user interaction (UI:R) driven by social engineering, so this is not a drive-by/wormable condition. No EPSS score, no SSVC decision data, and no CISA KEV entry were provided, and no POC or exploit code is referenced, so there is no evidence of active or automatable exploitation. Net: a genuinely patch-worthy browser flaw given Chrome's ubiquity, but realistically a Medium-severity, interaction-dependent information leak - not a critical emergency. Treat the 8.8/C:H:I:H:A:H as unverified and defer to the vendor's Medium rating; the description implies confidentiality-only impact. |
| Exploit ScenarioDerived | An attacker uses social engineering (e.g. a phishing link or malicious ad) to lure a macOS Chrome user to a crafted HTML page. When the browser incorrectly resolves a reference while rendering that page, sensitive information is exposed to attacker-controlled content and exfiltrated. No public exploit code is referenced, and the attack cannot succeed without the victim actively opening the malicious page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Incorrect reference resolution in Google Chrome on macOS before 155.0.8059.39 can disclose sensitive information to a remote attacker who uses social engineering to make the victim load a crafted HTML page. Exploitation requires a macOS user running an affected Chrome build who actively opens attacker-supplied content (UI:R), with no authentication required (PR:N) and network-delivered payloads (AV:N); there is no confirmed active exploitation and no public exploit code identified at time of analysis, and the only data supplied is a vendor patch and a Chromium issue. The signals conflict sharply: the headline CVSS of 8.8 (C:H/I:H/A:H) is not supported by the available evidence, and the assessed vector is confidentiality-only (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, roughly 6.5 Medium), matching Chromium's own 'Medium' severity label, so real-world priority is lower than the 8.8 figure implies.
RemediationAI
Vendor-released patch: Chrome 155.0.8059.39. Update Google Chrome on macOS to 155.0.8059.39 or later via the built-in updater (chrome://settings/help) or the stable-channel release documented at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, and confirm the reported version actually changed, since Chrome's background update can lag on long-running macOS sessions - a restart is typically required. Because the fix is a full browser upgrade with no separate component to toggle, there is no partial mitigation for the vulnerable resolution logic; if immediate patching is impossible, reduce exposure by enforcing a managed minimum-version policy through MDM/Chrome Browser Cloud Management on macOS (trade-off: users pinned to older macOS releases that cannot run the current Chrome will be forced onto an unsupported browser or a different product), temporarily restricting use of Chrome on macOS to trusted destinations through enterprise URL filtering (trade-off: crafted HTML can be delivered from compromised legitimate sites and the disclosure is not detectable at the network layer), and reinforcing social-engineering awareness since exploitation requires the victim to open attacker-supplied content (trade-off: user behaviour is not a reliable control). Do not rely on disabling JavaScript or extensions as a workaround - neither addresses an incorrect reference-resolution defect in the browser itself - and expect variable availability of this fix in downstream Chromium-based browsers until they rebase on 155.0.8059.39.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-706 (Use of Incorrectly-Resolved Name or Reference), a class of bug in which software maps an identifier, name, or reference to the wrong target - here, resolving a reference incorrectly inside Chrome's browser process on macOS, so content handled in one context is resolved to another and data leaks across that boundary. The attack surface is a crafted HTML page, meaning the vulnerable resolution path is reachable from ordinary web content rendered by Blink/Chrome rather than from a privileged local interface; the attacker gains information disclosure, not memory corruption, which is why the assessed vector carries C:H with I:N/A:N. The CPE supplied (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is version- and platform-agnostic and therefore does not capture the macOS-only, pre-155.0.8059.39 scope described in the description and the independent assessment; the ENISA EUVD entry mirrors the same affected range below 155.0.8059.39. The report originates from Chrome's own security process (Chromium issue 497842821), and the restricted bug-tracker reference means root-cause detail beyond the CWE-706 classification is not publicly available. Notably, the vendor-rated Chromium severity is Medium and the assessed impact is disclosure-only, both of which contradict the 8.8 score with full integrity and availability impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page needing victim interaction (UI:R, PR:N); description and vendor Medium rating indicate information disclosure only, so C:H but I:N/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on macOS versions prior to 155.0.8059.39 contains an incorrect reference resolution flaw that could allow a remote attacker to disclose sensitive information through social engineering. While the headline CVSS is 8.8, the actual risk is confidentiality-only, requires user interaction, and aligns with Chromium's Medium severity label. Organizational impact is limited to macOS users who actively open attacker-supplied content, and no active exploitation or public exploit code has been identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB