EUVD-2026-35210
GHSA-m67c-5qcr-q2mm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Insufficient network policy enforcement in Google Chrome prior to 149.0.7827.103 allows a remote unauthenticated attacker - who has already compromised the browser's utility process - to leak cross-origin data by luring a victim to a crafted HTML page. The confidentiality impact is limited and scoped unchanged, yielding a CVSS base score of just 3.1 (Low). No public exploit exists and CISA SSVC confirms exploitation status as none at time of analysis.
Technical ContextAI
Google Chrome's architecture separates browser functionality into isolated processes, including a utility process responsible for tasks like audio decoding, network service, and other sandboxed operations. CWE-693 (Protection Mechanism Failure) identifies the root cause: Chrome's network layer fails to adequately enforce same-origin or cross-origin data isolation policies when the utility process has been compromised. This failure allows the compromised process to read data across origin boundaries that should be policy-blocked, violating Chrome's Site Isolation and process sandbox guarantees. The affected product is Google Chrome across all platforms prior to version 149.0.7827.103, as confirmed by the EUVD affected version range 'Chrome 149.0.7827.103 <149.0.7827.103'.
RemediationAI
The primary fix is upgrading Google Chrome to version 149.0.7827.103 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome's automatic update mechanism will deliver this patch to most users without manual intervention; administrators managing enterprise deployments should verify the update has been applied via chrome://settings/help. Because exploitation requires a pre-compromised utility process as a prerequisite, organizations should also ensure Chrome's built-in sandbox protections (Site Isolation, process sandboxing) are not disabled by enterprise policy, as disabling these increases the attack surface that would enable the prerequisite compromise. No workarounds are documented for this specific policy enforcement bypass beyond applying the patch.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today