EUVD-2026-34566
GHSA-9423-728h-v679
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebUI component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to extract sensitive cross-origin information via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the WebUI layer, which fails to properly sanitize input arriving from a compromised renderer, breaking Chrome's intended process isolation boundary. No active exploitation has been confirmed (not in CISA KEV), and an EPSS score of 0.04% (13th percentile) reflects low widespread exploitation probability, consistent with this being a second-stage technique requiring a chained renderer compromise.
Technical ContextAI
Chrome's WebUI is an internal privileged rendering layer that powers browser-native pages such as settings, extensions, and new tab interfaces, implemented using standard web technologies but operating with elevated browser-level trust. Chrome's security model relies on process isolation - site isolation and sandbox boundaries - to ensure that even a fully compromised renderer cannot interact with privileged browser internals. CWE-20 (Improper Input Validation) is the root cause: the WebUI component does not adequately validate or sanitize input originating from the renderer process, allowing a compromised renderer to influence WebUI behavior and induce cross-origin data disclosure. The affected product is Google Chrome across all desktop platforms (Windows, macOS, Linux) for versions prior to 149.0.7827.53, as confirmed by ENISA EUVD-2026-34566 and the vendor stable channel advisory.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later immediately, as detailed in the vendor stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome performs automatic background updates on most consumer installations; enterprise administrators should verify that managed update policies (Google Update, Omaha, or platform-native MDM controls) are enforcing the minimum version of 149.0.7827.53 and confirm deployment via fleet inventory tools. Because this vulnerability requires a prior renderer compromise as a precondition, reducing renderer exploit exposure is a meaningful secondary control: ensure Chrome is kept current to minimize the attack surface for renderer-level vulnerabilities, enforce site isolation via enterprise policy (--enable-strict-site-isolation), and audit installed extensions for untrusted or overprivileged entries, as extensions operate in renderer contexts. No specific workaround for this WebUI validation flaw itself is documented by the vendor.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today