EUVD-2026-34707
GHSA-q633-h8hg-5mvc
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in Google Chrome's IndexedDB implementation affects all versions prior to 149.0.7827.53, enabling an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. The integrity-only impact (C:N/I:H/A:N) means a successful exploitation could allow unauthorized writes or data manipulation across origins, but does not directly expose confidential data. No public exploit code has been identified at time of analysis, and Google's own Chromium security team rated this Low severity; a vendor-released patch is available at version 149.0.7827.53.
Technical ContextAI
IndexedDB is a browser-native NoSQL key-value storage API exposed to web content through the renderer process. Insufficient validation of untrusted input (CWE-20) in Chrome's IndexedDB handling means that data or requests originating from a compromised renderer are not properly sanitized before being acted upon at a higher privilege boundary. The same-origin policy (SOP) is a foundational browser security control preventing cross-origin data access; a bypass here undermines a core web isolation guarantee. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U) indicates the attack originates over the network, requires high complexity (notably a pre-compromised renderer), does not require prior authentication, but does require user interaction. The affected CPE scope is Google Chrome releases prior to 149.0.7827.53, as confirmed by EUVD-2026-34707 and the Chrome stable channel advisory.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later via the browser's built-in update mechanism or through enterprise management tooling; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because exploitation requires a pre-compromised renderer process, organizations that enforce Chrome's Site Isolation feature (--site-per-process, enabled by default in modern Chrome) and keep renderer sandbox hardening enabled already have a significant compensating control in place, as renderer compromise itself becomes harder. There is no documented workaround that mitigates the IndexedDB validation gap without patching. Disabling JavaScript or blocking IndexedDB API access via enterprise policy would prevent exploitation but would break a broad class of web applications and is not recommended as a standing control. Prioritize patching over workarounds given patch availability.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today