EUVD-2026-34469
GHSA-hjpv-wxpg-mvhc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted XML file. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data disclosure in Google Chrome's Extensions component (versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data belonging to other origins by delivering a crafted XML file to a victim. The CVSS vector confirms network-reachable, unauthenticated access (AV:N/PR:N) with High confidentiality impact, though user interaction is required (UI:R). No public exploit has been identified at time of analysis and EPSS probability sits at a low 0.03% (11th percentile), indicating limited exploitation likelihood despite the meaningful confidentiality impact.
Technical ContextAI
The root cause is CWE-346 (Origin Validation Error) - a class of flaws where a browser component fails to correctly enforce same-origin policy boundaries. Here, the Extensions subsystem in Chromium improperly processes or exposes data from a crafted XML file without adequate origin checking, permitting cross-origin reads that the browser's security model is designed to prevent. Affected product per EUVD-2026-34469: Google Chrome (desktop, stable channel) all versions in the range < 149.0.7827.53. The Chromium issue tracker entry (issues.chromium.org/issues/497440270) likely holds further technical detail, though public visibility of that ticket is not confirmed. The flaw is classified as 'Inappropriate implementation' - Chromium's internal severity taxonomy for logic or policy violations rather than memory-safety bugs - and was rated Medium by the Chromium security team, consistent with the 6.5 CVSS base score.
RemediationAI
The primary remediation is to update Google Chrome to version 149.0.7827.53 or later, which is the vendor-confirmed fixed release per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Most consumer Chrome installs will update automatically, but enterprise administrators should validate rollout across managed fleets using Chrome Browser Cloud Management or equivalent policy tooling and confirm the installed version matches or exceeds 149.0.7827.53. As a compensating control during the patching window, administrators can restrict or disable Chrome extensions at the enterprise level via Chrome ExtensionInstallBlocklist or ForceInstallList policies - this directly reduces the attack surface in the vulnerable Extensions component, though it may break workflows dependent on browser extensions and requires careful policy scoping. Secondary mitigation involves user awareness: since UI:R is required, advising users not to open XML files from untrusted sources provides a behavioral control with no system-level trade-offs.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today