EUVD-2026-34465
GHSA-5c49-xx75-xq3h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same origin policy bypass in Google Chrome's Network component (prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to exfiltrate or manipulate cross-origin data via a crafted HTML page. The integrity impact is rated High (I:H) with no confidentiality or availability impact, meaning the primary risk is unauthorized cross-origin writes or request forgery rather than data theft. No public exploit code has been identified at time of analysis, and EPSS sits at 0.02% (6th percentile), indicating low observed exploitation probability despite the medium CVSS score.
Technical ContextAI
The vulnerability resides in Chrome's Network component and is classified under CWE-20 (Improper Input Validation) - the browser fails to adequately validate untrusted input originating from a renderer process before acting on it at the network layer. The same origin policy (SOP) is a foundational browser security boundary preventing scripts from one origin from interacting with resources from another. A compromised renderer - Chrome's sandboxed content process - can exploit this validation gap to send malformed or crafted network requests that the browser's network stack incorrectly services without enforcing SOP checks. This is architecturally significant: Chrome's multi-process model is designed so that even a fully compromised renderer cannot cross process trust boundaries, making this a partial sandbox bypass at the network layer. Affected CPE: Google Chrome versions prior to 149.0.7827.53 on all supported desktop platforms.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later, which is the vendor-released patch confirmed via the Google Chrome Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Chrome's auto-update mechanism should deliver this update automatically; administrators managing enterprise fleets should verify deployment via Google Admin Console or Chrome Browser Cloud Management. For environments where immediate patching is not feasible, the most effective compensating control is to restrict users from visiting untrusted or external HTML pages and to enforce Chrome's Enhanced Protection mode in Safe Browsing settings, which may reduce renderer compromise risk from the prerequisite stage. Disabling JavaScript on untrusted sites via policy would also reduce the renderer attack surface, though with significant usability trade-offs. Since exploitation requires a prior renderer compromise, prioritizing defense against renderer exploits (e.g., enforcing process isolation policies, blocking known exploit delivery vectors) is a meaningful upstream mitigation.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today