Description
Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Published: 2026-09-29
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass / Unauthorized Access
Action: Update Chrome
AI Analysis

Impact

The vulnerability is a missing authorization check in Chrome's DevTools component. A remote attacker can, through social engineering, craft network traffic that bypasses system access restrictions and gains unauthorized access to system resources. The weakness is classified as CWE-862 and is rated Medium severity by Chromium.

Affected Systems

Google Chrome users running versions earlier than 154.0.8037.57 are affected. The flaw resides in the DevTools functionality of the browser.

Risk and Exploitability

Exploitation requires a social engineering attack that leads the victim to trigger crafted network traffic, so user interaction is necessary. With a CVSS score of 4.8, the vulnerability is classified as Medium severity. The EPSS score is < 1%, indicating a very low exploitation probability. The flaw can be abused remotely to gain unauthorized access to system resources. It is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 1, 2026 at 00:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 154.0.8037.57 or newer
  • If an update cannot be applied immediately, disable or restrict DevTools access through Chrome policies or extensions
  • Educate users about social engineering tactics that may trigger malicious DevTools usage

Generated by OpenCVE AI on October 1, 2026 at 00:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Missing authorization in DevTools
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 01 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Thu, 01 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title DevTools Authorization Bypass in Google Chrome

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Title DevTools Authorization Bypass in Google Chrome

Tue, 29 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
Weaknesses CWE-862
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-30T20:11:07.210Z

Reserved: 2026-09-22T05:07:53.930Z

Link: CVE-2026-95300

cve-icon Vulnrichment

Updated: 2026-09-30T19:55:26.052Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:21.970

Modified: 2026-10-01T15:07:09.860

Link: CVE-2026-95300

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T17:31:52Z

Links: CVE-2026-95300 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T00:45:07Z

Weaknesses