EUVD-2026-34485
GHSA-v4w3-fffw-5h9j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome prior to 149.0.7827.53 enables remote unauthenticated attackers to violate cross-origin isolation boundaries through a crafted HTML page, producing high integrity impact with no confidentiality or availability loss. Rooted in an inappropriate DOM implementation (CWE-346: Origin Validation Error), the flaw allows a malicious page to cross origin boundaries and manipulate content or state belonging to a different origin. No public exploit code and no CISA KEV listing exist at time of analysis; the EPSS score of 0.02% (4th percentile) reinforces limited real-world exploitation pressure despite the medium CVSS 6.5 rating.
Technical ContextAI
The vulnerability resides in Chrome's Document Object Model (DOM) implementation and is classified as CWE-346 (Origin Validation Error). The same-origin policy (SOP) is a foundational browser security primitive restricting cross-origin script interaction with resources such as cookies, DOM state, and network responses. An 'inappropriate implementation' in the DOM layer indicates that Chrome fails to correctly enforce origin checks in a specific execution path, permitting a crafted HTML page to influence or modify content governed by a different origin. The affected product is Google Chrome desktop (Windows, macOS, Linux) for all versions prior to 149.0.7827.53, as confirmed by the Chrome stable channel advisory and ENISA EUVD-2026-34485. The Chromium issue tracker entry (https://issues.chromium.org/issues/497964917) may contain additional technical detail but is likely access-restricted pending broader patch adoption.
RemediationAI
Vendor-released patch: Chrome 149.0.7827.53. Update Google Chrome to version 149.0.7827.53 or later using the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on most desktop configurations; enterprise administrators using managed deployments (Google Admin Console, GPO, or Intune) should validate update rollout and confirm the installed version via chrome://settings/help. As a compensating control pending patch deployment, enforcing a Content Security Policy (CSP) on sensitive web applications can partially limit the damage of a SOP bypass by restricting what cross-origin interactions are permitted - though this mitigates impact on defender-controlled sites, not the browser flaw itself. Disabling JavaScript is a theoretical but operationally disruptive workaround not recommended for general use. Given the UI:R requirement, user-awareness guidance against clicking unsolicited links provides marginal but real risk reduction.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today