Loading vulnerability…
CVE-2026-95290 is an origin-validation flaw in Google Chrome WebNFC permission handling. WebNFC requests originating from sandboxed or otherwise opaque-origin documents could reach permission evaluation without being rejected. During origin normalization, an opaque origin could be represented by an empty URL and cause evaluation to fall back to the WebContents visible URL. Consequently, permission evaluation could be associated with a visible primary-frame URL rather than the opaque origin that initiated the request. The fix blocks WebNFC binding and permission evaluation for opaque-origin documents.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Google Chrome vulnerability addressed in version 154.0.8037.57; no flaw-specific details are provided.
A WebNFC origin-validation and permission-bypass vulnerability in Chromium's NFCHost/NFC permission handling. An attacker with a compromised renderer could potentially cause an opaque-origin sandboxed popup to inherit a victim origin's previously granted WebNFC permission through a GetVisibleURL fallback. Chromium fixed the issue by explicitly blocking opaque origins in NFCHost and NfcPermissionContext.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.