Description
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

A missing authorization check in the Actor component of Google Chrome allowed a remote attacker to exploit a crafted HTML page via social engineering. The flaw lets a malicious actor bypass system access restrictions, effectively elevating privileges without proper permission validation. The weakness is identified as an authorization gap (CWE-266) and an improper privilege check (CWE-862).

Affected Systems

This vulnerability affects Google Chrome versions earlier than 155.0.8059.39. Any installation of Chrome that has not been upgraded to 155.0.8059.39 or later is potentially exploitable.

Risk and Exploitability

The flaw carries a CVSS score of 5.4, indicating medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a user to view a malicious HTML page, after which the attacker can inject content or commands and potentially gain system-level access, making the impact on confidentiality, integrity, and availability significant if the flaw is exploited.

Generated by OpenCVE AI on October 7, 2026 at 16:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 155.0.8059.39 or later
  • Configure Chrome to automatically apply updates without user intervention
  • For enterprise deployments, enforce a policy that requires the patched version to be installed on all user devices

Generated by OpenCVE AI on October 7, 2026 at 16:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Wed, 07 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Wed, 07 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Missing Authorization in Actor Allows Remote Privilege Escalation via Crafted HTML Page chromium-browser: chromium-browser: Missing authorization in Actor
Weaknesses CWE-266
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

threat_severity

Moderate

Tue, 06 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Missing Authorization in Actor Allows Remote Privilege Escalation via Crafted HTML Page

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T20:34:19.279Z

Reserved: 2026-10-06T16:33:30.502Z

Link: CVE-2026-106250

cve-icon Vulnrichment

Updated: 2026-10-07T20:24:28.303Z

cve-icon NVD

Status : Modified

Published: 2026-10-06T19:17:52.053

Modified: 2026-10-07T21:17:12.227

Link: CVE-2026-106250

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:34Z

Links: CVE-2026-106250 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T16:15:18Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-862

    Missing Authorization