Description
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Disclosure
Action: Immediate Patch
AI Analysis

Impact

An incorrect reference resolution flaw in Google Chrome on macOS permits a remote attacker, using social engineering to luring a user to a specially crafted HTML page, to gain access to sensitive information that the browser would normally protect. The flaw is classified as Improper Access Control (CWE‑706).

Affected Systems

The vulnerability is present in all Google Chrome for macOS versions earlier than 155.0.8059.39. Versions 155.0.8059.40 and later contain the fix, so any machine running the outdated browser remains susceptible.

Risk and Exploitability

The issue carries a CVSS score of 8.8, indicating high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack requires only a malicious web page and a user’s interaction, the probability of exploitation depends largely on successful social engineering; once triggered, the attacker can expose private information to which the browser should have restricted access.

Generated by OpenCVE AI on October 7, 2026 at 02:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Chrome 155.0.8059.40 or later on all macOS devices.
  • Configure enterprise policies or use the Chrome Update for Mac to enforce automatic updates across all user accounts.
  • Inform users about the threat and advise them to avoid visiting suspicious or unexpected web pages.

Generated by OpenCVE AI on October 7, 2026 at 02:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Incorrect Reference Resolution Enables Sensitive Data Disclosure on macOS Chrome chromium-browser: Incorrect reference resolution in Browser
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 08 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos

Wed, 07 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Incorrect Reference Resolution Enables Sensitive Data Disclosure on macOS Chrome

Tue, 06 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-706
References

Subscriptions

Apple Macos
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:25:51.606Z

Reserved: 2026-10-06T16:34:06.202Z

Link: CVE-2026-106274

cve-icon Vulnrichment

Updated: 2026-10-06T20:17:08.377Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:55.023

Modified: 2026-10-08T18:01:16.190

Link: CVE-2026-106274

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:16Z

Links: CVE-2026-106274 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T02:45:10Z

Weaknesses
  • CWE-706

    Use of Incorrectly-Resolved Name or Reference