CVE-2026-95289

Analyzed Analyzed - Analysis Complete

Incorrect Authorization in Scroll in Google Chrome

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Chrome

Description

Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95289

EUVD

EUVD-2026-89141

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect authorization in Scroll in Google Chrome before version 154.0.8037.57. A remote attacker could exploit it through social engineering to access cross-origin data by tricking a user into visiting a crafted HTML page.

Detection Guidance

This vulnerability involves incorrect authorization in Google Chrome. Detection primarily requires checking the Chrome version installed on systems. Use commands like 'google-chrome --version' or 'chromium-browser --version' to verify if the version is below 154.0.8037.57.

Impact Analysis

An attacker could steal sensitive data from other websites you visit while using the vulnerable Chrome version. This might include personal information, login credentials, or other confidential data exposed through cross-origin requests.

Compliance Impact

This vulnerability involves incorrect authorization allowing cross-origin data access via social engineering. While not directly tied to GDPR or HIPAA, improper authorization could lead to unauthorized data exposure, potentially violating confidentiality requirements in these regulations.

Mitigation Strategies

Immediately update Google Chrome to version 154.0.8037.57 or later. Disable automatic updates temporarily if needed, but prioritize patching to prevent exploitation. Avoid visiting untrusted websites until the update is applied.

Hi! I’m here to help you understand CVE-2026-95289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70