EUVD-2026-34462
GHSA-hm5x-5c3q-w6ch
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Memory disclosure in Google Chrome's Network component (versions prior to 149.0.7827.53) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page to the victim. This is a chained, two-stage attack: exploitation requires a prior renderer process compromise as an explicit prerequisite, which substantially elevates the real-world difficulty beyond what the CVSS 6.5 score alone implies. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.05% at the 15th percentile), and no public exploit code exists at time of analysis.
Technical ContextAI
The vulnerability resides in Chromium's Network component, which processes network requests and responses within Chrome's multi-process, sandboxed architecture. CWE-20 (Improper Input Validation) identifies the root cause as a failure to adequately validate untrusted input originating from the network layer before operating on it in memory. In Chromium's process model, the renderer handles page rendering inside a sandbox while the Network Service process handles privileged network operations - insufficient validation at the boundary between these components is what enables memory disclosure when the renderer is already under attacker control. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop versions prior to 149.0.7827.53 across platforms, as confirmed by EUVD-2026-34462.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch. The stable channel update announcement is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should enforce the update via Chrome's managed browser policies (e.g., Google Admin Console or GPO-based update management). Because exploitation explicitly requires a prior renderer process compromise, organizations with endpoint detection and response (EDR) tools capable of detecting renderer sandbox escapes gain an additional defensive layer that would interrupt the attack chain before this vulnerability becomes relevant. Restricting users from visiting untrusted or unsolicited HTML pages via web proxy filtering also reduces exposure while patching is in progress. No workaround that eliminates the vulnerability without patching has been identified in available references.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today