Description
Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-09-29
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑origin data disclosure via missing authorization
Action: Patch Now
AI Analysis

Impact

The vulnerability is a missing authorization check in the Core component of Google Chrome on macOS that allows a remote attacker, using social engineering to trick a user into opening a crafted HTML page, to read data from other origins the page should not normally access. This results in the disclosure of potentially sensitive user data such as web page content, cookies or local storage, and is classified as Missing Authorization (CWE‑862).

Affected Systems

Google Chrome for macOS versions earlier than 154.0.8037.57 are affected. Users running these releases on any macOS platform are at risk until an update is applied.

Risk and Exploitability

The CVSS score of 4.3 indicates a low‑to‑moderate risk level, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog. Practical exploitation would require the attacker to lure a user to a malicious page, making social engineering the most likely attack vector. No advanced prerequisites or complex system compromise are needed to exploit the flaw.

Generated by OpenCVE AI on September 30, 2026 at 11:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Chrome update 154.0.8037.57 or later from the official Google channel
  • Train users to avoid clicking unknown or suspicious links that could host malicious HTML files
  • Enable Chrome Safe Browsing and monitor web activity for anomalous page loads that might indicate social engineering attempts

Generated by OpenCVE AI on September 30, 2026 at 11:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Missing authorization in Core
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 30 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos

Wed, 30 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Disclosure via Missing Authorization in Chrome on macOS

Tue, 29 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Disclosure via Missing Authorization in Chrome on macOS

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-862
References

Subscriptions

Apple Macos
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-29T19:16:09.711Z

Reserved: 2026-09-22T05:07:48.318Z

Link: CVE-2026-95296

cve-icon Vulnrichment

Updated: 2026-09-29T19:16:03.516Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:21.473

Modified: 2026-09-30T19:55:11.870

Link: CVE-2026-95296

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-29T17:32:00Z

Links: CVE-2026-95296 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T11:30:18Z

Weaknesses