PULSE
ES
FEED
ransomrhysida reclama a Here at Pope and Johnson County Title Company · Financial Servicesransomorova reclama a MARDEC Berhad · MY · Manufacturingransomorova reclama a Hydrogel Vision Corporation · US · Healthcareransomorova reclama a Raffles United Holdings Pte Ltd · SG · Hospitalityransomobsoft reclama a Company #2 · KRransomobsoft reclama a New Victim Company #6ransompixelleaks reclama a Unnamed · ITransompayload reclama a Stahlbau Mann GmbH · DE · Manufacturingransomn0n reclama a Company #122 · USransomn0n reclama a Company #121 · USransomn0n reclama a Company #120 · USransomn0n reclama a Company #119ransomn0n reclama a Company #118 · AEransomnightspire reclama a REFSA S.A. · AR · Otherransomrhysida reclama a Here at Pope and Johnson County Title Company · Financial Servicesransomorova reclama a MARDEC Berhad · MY · Manufacturingransomorova reclama a Hydrogel Vision Corporation · US · Healthcareransomorova reclama a Raffles United Holdings Pte Ltd · SG · Hospitalityransomobsoft reclama a Company #2 · KRransomobsoft reclama a New Victim Company #6ransompixelleaks reclama a Unnamed · ITransompayload reclama a Stahlbau Mann GmbH · DE · Manufacturingransomn0n reclama a Company #122 · USransomn0n reclama a Company #121 · USransomn0n reclama a Company #120 · USransomn0n reclama a Company #119ransomn0n reclama a Company #118 · AEransomnightspire reclama a REFSA S.A. · AR · Other
← All CVEs
CVE WatchOct 26, 2026

CVE-2026-7932

Insufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restricti

CVSS

4.4

Medium

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Published: May 6, 2026 · Last modified: Oct 26, 2026 · CWE-693

EPSS · 30d
0.1%EPSS · 30 days0.1%
2026-10-052026-11-01
Technical description

Insufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-589468.4 HIG
—
———In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.7hCVE-2026-589348.4 HIG
—
———In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.7hCVE-2026-588378.4 HIG
—
———In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.7hCVE-2026-588367.8 HIG
—
———In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.7hCVE-2026-455148.4 HIG
—
———In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.7hCVE-2026-286456.8 MED
—
———In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15h