Description
Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Update Browser
AI Analysis

Impact

The vulnerability is an incorrect authorization flaw in Chrome’s WebProtect component, classified as CWE-863. A remote attacker can extract sensitive information from the victim’s browser session by delivering a specially crafted HTML page. This flaw does not allow code execution or system compromise but results in confidentiality loss of personal or corporate data that the browser handles.

Affected Systems

Google Chrome browsers running a version earlier than 155.0.8059.39 are affected. The flaw exists across all platforms where the WebProtect feature is active.

Risk and Exploitability

The CVSS score of 8.8 indicates a high impact. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower threat footprint. Likely exploitation requires a social‑engineering step in which the attacker persuades or tricks a user into opening a crafted HTML page, after which the attacker can read browser‑sensitive data.

Generated by OpenCVE AI on October 7, 2026 at 00:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 155.0.8059.39 or later to apply the WebProtect authorization fix.
  • Ensure that any custom extensions or scripts that interact with WebProtect are removed or updated to the vendor’s latest versions, as they may inadvertently expose the flaw.
  • Until the update is applied, avoid clicking on unexpected or suspicious HTML links, especially from untrusted sources, to mitigate the risk of social‑engineering exploitation.

Generated by OpenCVE AI on October 7, 2026 at 00:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Wed, 14 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title WebProtect Authorization Flaw Enables Remote Extraction of Sensitive Browser Data chromium-browser: Incorrect authorization in WebProtect
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title WebProtect Authorization Flaw Enables Remote Extraction of Sensitive Browser Data

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-863
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:25:50.804Z

Reserved: 2026-10-06T16:36:14.013Z

Link: CVE-2026-106352

cve-icon Vulnrichment

Updated: 2026-10-06T20:16:55.102Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:04.033

Modified: 2026-10-14T18:49:01.577

Link: CVE-2026-106352

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:31Z

Links: CVE-2026-106352 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T02:45:10Z

Weaknesses