Description
Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Bypass of system access restrictions via a crafted extension
Action: Patch install
AI Analysis

Impact

Improper input validation in the SignIn component of Google Chrome allowed a remote attacker to craft a malicious Chrome extension and use social engineering to trick users into installing it, thereby bypassing system access restrictions and potentially gaining unauthorized privileges.

Affected Systems

Google Chrome versions earlier than 155.0.8059.39 are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 6.5, indicating medium severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers would need to execute a social‑engineering scheme to get users to install a malicious extension, which would then allow them to bypass system access restrictions.

Generated by OpenCVE AI on October 7, 2026 at 21:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 155.0.8059.39 or later.
  • Remove any suspicious or unknown extensions from the browser.
  • Educate users on the risks of installing extensions from untrusted sources and verify extension origins before installation.

Generated by OpenCVE AI on October 7, 2026 at 21:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Improper input validation in SignIn
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 08 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Title Chrome SignIn Input Validation Flaw Allows Social Engineering Attack to Bypass Access Restrictions via Crafted Extension

Wed, 07 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Title Chrome SignIn Input Validation Flaw Allows Social Engineering Attack to Bypass Access Restrictions via Crafted Extension

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T19:57:08.551Z

Reserved: 2026-10-06T16:33:50.459Z

Link: CVE-2026-106263

cve-icon Vulnrichment

Updated: 2026-10-07T19:57:04.416Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:53.763

Modified: 2026-10-08T18:03:43.140

Link: CVE-2026-106263

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:31Z

Links: CVE-2026-106263 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T22:00:06Z

Weaknesses
  • CWE-20

    Improper Input Validation