CVE Intelligence
Analysis AI-assisted

CVE-2026-0905: Google Chrome Network policy flaw exposing sensitive data in network logs

CVE-2026-0905 is an insufficient policy enforcement issue in the Network component of Google Chrome before 144.0.7559.59. According to the record, an attacker who obtains a network log file could potentially retrieve sensitive information from it. The CNA and CISA-ADP both report a CVSS score of 9.8, while the record also notes a Chromium security severity of Medium.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0905 concerns Google Chrome builds before 144.0.7559.59, where insufficient policy enforcement in the Network component may allow a party who has obtained a network log file to retrieve potentially sensitive information. The record classifies the weakness as CWE-200, Exposure of Sensitive Information. The vendor release notes are the primary advisory cited in the record.

Impact

  • Confidentiality: potential exposure of sensitive data contained in network log files.
  • The CVSS score of 9.8 reported by the CNA and CISA-ADP corresponds to a critical rating. This is a scoring assessment, not a demonstrated consequence.
  • The Chromium security severity label is Medium, which differs from the critical CVSS rating. The record does not explain the difference.

Affected products and versions

  • Product: Google Chrome.
  • The description identifies builds before 144.0.7559.59 as affected.
  • The record lists 144.0.7559.59 and 144.0.7559.60 as allowed version strings, but its affected-range entries are inconsistent. One entry describes a range that cannot match any build.
  • Organizations should verify installed Chrome builds against the vendor release notes rather than relying on a single range.

Exploitation status

  • The record does not list this vulnerability in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is 0.00248 with a percentile of 0.15164. This is a statistical estimate of exploitation likelihood, not evidence of exploitation.
  • The SSVC fields in the record report exploitation as none and automatable as yes.

Remediation and mitigation

  • Update Google Chrome to 144.0.7559.59 or later through the vendor release channel.
  • The record contains no structured fix entry, so the fixed boundary is taken from the description and the vendor release notes.
  • Restrict access to network log files, treat them as sensitive data, and limit retention where they are not required.

Detection guidance

  • Inventory Chrome installations and their build numbers to identify hosts running builds before 144.0.7559.59.
  • Monitor for unexpected access, copying or sharing of browser network log files.
  • Review access records for file repositories where network logs are stored.

Limitations of the available information

  • The record provides no technical details of the flaw and no exploitation evidence.
  • The affected-range entries contain an inconsistent condition.
  • The EPSS date field in the record does not align with the publication date and should be treated with caution.
  • The record does not explain why the Chromium severity differs from the CVSS rating.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-0905?

The description identifies Google Chrome builds before 144.0.7559.59 as affected. The affected-range entries in the record are inconsistent, so checking the vendor release notes is recommended.

Is CVE-2026-0905 known to be exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.