Description
Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Origin Policy Bypass
Action: Update Chrome
AI Analysis

Impact

The vulnerability is an incorrect authorization flaw in the Network layer of Google Chrome, allowing a remote attacker to bypass the browser's same‑origin policy via a crafted HTML page. This flaw lets an attacker read or manipulate cross‑origin resources or execute scripts in the context of a target origin, potentially compromising confidentiality and integrity depending on the data accessed.

Affected Systems

The issue affects Google Chrome versions earlier than 154.0.8037.57 on all supported platforms. Users running those releases are vulnerable.

Risk and Exploitability

The CVE is rated Medium severity in Chromium, with a CVSS score of 6.5 and an EPSS score of < 1%. The attack can be launched remotely simply by delivering a malicious HTML page to the victim, so any user who visits a compromised or malicious website could be impacted. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 1, 2026 at 19:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Google Chrome 154.0.8037.57 or later on all endpoints.
  • Configure the browser’s auto‑update or enterprise management tools to ensure all users receive the patch promptly.
  • Enable and review Chrome security logs for cross‑origin policy violations to detect potential exploitation attempts.

Generated by OpenCVE AI on October 1, 2026 at 19:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Incorrect authorization in Network
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 02 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Thu, 01 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-863
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-01T16:23:47.008Z

Reserved: 2026-09-22T05:11:05.652Z

Link: CVE-2026-95374

cve-icon Vulnrichment

Updated: 2026-10-01T16:23:18.249Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:31.373

Modified: 2026-10-02T15:13:32.743

Link: CVE-2026-95374

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T17:31:52Z

Links: CVE-2026-95374 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T19:45:03Z

Weaknesses