Description
Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via unexpected UI authorization bug
Action: Patch
AI Analysis

Impact

Incorrect authorization in Chrome’s UI allowed a remote attacker to potentially execute code outside the sandbox using a crafted HTML page. The weakness is identified as CWE‑863 and is classified as a medium severity vulnerability. An attacker who can lure a user to view the malicious page could gain the ability to run arbitrary code with the privileges of the user’s browser process.

Affected Systems

Google Chrome users with software versions earlier than 155.0.8059.39 are affected. All installations of Chrome that have not applied the latest security update fall within the risk window.

Risk and Exploitability

The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, but the CVSS score of 9.6 indicates a high severity risk. The likely attack vector is a remote attacker delivering a specially crafted HTML page to a user’s browser. If successful, the attacker would obtain code execution capabilities beyond the chrome sandbox, potentially compromising the device and any data accessible to the user.

Generated by OpenCVE AI on October 7, 2026 at 00:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 155.0.8059.39 or later via the official update mechanism.
  • Enable automatic updates to ensure timely protection against future vulnerabilities.
  • Educate users to avoid opening untrusted HTML content and monitor for anomalous browser behavior.

Generated by OpenCVE AI on October 7, 2026 at 00:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Incorrect authorization in UI
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Incorrect Authorization in Chrome UI Allows Remote Code Execution via Crafted HTML

Tue, 06 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Incorrect Authorization in Chrome UI Allows Remote Code Execution via Crafted HTML

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-863
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-07T03:56:01.618Z

Reserved: 2026-10-06T16:36:51.719Z

Link: CVE-2026-106372

cve-icon Vulnrichment

Updated: 2026-10-06T20:35:14.894Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:06.300

Modified: 2026-10-07T13:46:49.840

Link: CVE-2026-106372

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:33Z

Links: CVE-2026-106372 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T02:15:10Z

Weaknesses