EUVD-2026-34645
GHSA-6w6g-q7qh-cv9h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to 149.0.7827.53 allows a remote, unauthenticated attacker to circumvent policy enforcement in the browser's Actor component by delivering a crafted HTML page to a target user. The flaw (CWE-602) enables unauthorized navigation actions that could expose users to cross-origin manipulation or redirects with low but non-trivial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS of 0.02% combined with SSVC exploitation status of none indicates limited active threat, though the broad attack surface of any Chrome desktop user visiting a malicious page warrants timely patching.
Technical ContextAI
The vulnerability resides in the 'Actor' subsystem of the Chromium rendering engine - a component responsible for managing browsing context, navigation lifecycle, and cross-origin policy enforcement. CWE-602 (Client-Side Enforcement of Server-Side Security) describes the root cause class: security decisions that should be enforced at a privileged or trusted layer are instead insufficiently enforced client-side, allowing crafted content to manipulate navigation in policy-violating ways. In Chrome's architecture, the Actor component mediates navigation requests between renderer processes and the browser process; insufficient enforcement here means a renderer-controlled HTML page can trigger navigations that should be blocked by origin or content security policies. Affected products map to Google Chrome desktop versions below 149.0.7827.53 across platforms, per EUVD-2026-34645.
RemediationAI
The primary fix is to update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates for most consumer deployments, but enterprise administrators should verify fleet update status via Chrome Browser Cloud Management or equivalent MDM tooling to confirm propagation. As a compensating control while patching is pending, web filtering or proxy policies that restrict user access to untrusted or uncategorized URLs will reduce exposure, since exploitation requires the user to visit a crafted page. Enforcing Chrome enterprise policy to restrict navigation to an approved-domain allowlist would also limit the exploitable surface, but introduces usability trade-offs for general browsing. Disabling JavaScript for untrusted sites may further reduce attack surface but will break substantial legitimate web functionality and is not recommended as a long-term measure. No vendor-documented workaround short of patching has been identified.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today