CVE-2026-91732

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Scoring

CVSS base score

0

EPSS probability

0.25%

CWE

CWE-862

Published

2026-09-15

Last modified

2026-09-16

Affected products

• Google Chrome

Weakness type

• CWE-862

Related vulnerabilities

• CVE-2026-8821 — Playbooks run owner channel membership permission bypass
• CVE-2026-20324 — Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability
• CVE-2026-57139 — PraisonAI MCPServer exposes unauthenticated HTTP tools/call
• CVE-2026-75030 — Apache Syncope: Incomplete authorization checks for Group members deprovisioning
• CVE-2026-57131 — praisonai: Jobs API exposes agent-execution endpoints with no authentication
• CVE-2026-14349 — TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
• CVE-2026-66887 — Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups
• CVE-2026-38056 — ST Engineering iDirect iQ-Series Terminals Missing Authorization

Markdown version · Browse all CVEs