EUVD-2026-34566
GHSA-9423-728h-v679
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebUI component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to extract sensitive cross-origin information via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the WebUI layer, which fails to properly sanitize input arriving from a compromised renderer, breaking Chrome's intended process isolation boundary. No active exploitation has been confirmed (not in CISA KEV), and an EPSS score of 0.04% (13th percentile) reflects low widespread exploitation probability, consistent with this being a second-stage technique requiring a chained renderer compromise.
Technical ContextAI
Chrome's WebUI is an internal privileged rendering layer that powers browser-native pages such as settings, extensions, and new tab interfaces, implemented using standard web technologies but operating with elevated browser-level trust. Chrome's security model relies on process isolation - site isolation and sandbox boundaries - to ensure that even a fully compromised renderer cannot interact with privileged browser internals. CWE-20 (Improper Input Validation) is the root cause: the WebUI component does not adequately validate or sanitize input originating from the renderer process, allowing a compromised renderer to influence WebUI behavior and induce cross-origin data disclosure. The affected product is Google Chrome across all desktop platforms (Windows, macOS, Linux) for versions prior to 149.0.7827.53, as confirmed by ENISA EUVD-2026-34566 and the vendor stable channel advisory.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later immediately, as detailed in the vendor stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome performs automatic background updates on most consumer installations; enterprise administrators should verify that managed update policies (Google Update, Omaha, or platform-native MDM controls) are enforcing the minimum version of 149.0.7827.53 and confirm deployment via fleet inventory tools. Because this vulnerability requires a prior renderer compromise as a precondition, reducing renderer exploit exposure is a meaningful secondary control: ensure Chrome is kept current to minimize the attack surface for renderer-level vulnerabilities, enforce site isolation via enterprise policy (--enable-strict-site-isolation), and audit installed extensions for untrusted or overprivileged entries, as extensions operate in renderer contexts. No specific workaround for this WebUI validation flaw itself is documented by the vendor.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today