EUVD-2026-35217
GHSA-6mr8-wmr4-ch9v
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's New Tab Page (NTP) component prior to version 149.0.7827.103 enables an unauthenticated remote attacker - who has already achieved renderer process compromise - to exfiltrate cross-origin data via a crafted HTML page. The vulnerability stems from insufficient input validation in the NTP, exploitable only as a second-stage attack chained after a separate renderer exploit. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS base score of 3.1 (Low) accurately reflects the constrained impact: confidentiality-only, low severity, high attack complexity.
Technical ContextAI
The affected component is Chrome's New Tab Page (NTP), a privileged browser UI surface rendered within the browser process but receiving input from (or interacting with) renderer-side content. CWE-20 (Improper Input Validation) indicates that untrusted input from the renderer is not adequately sanitized or verified before being processed by the NTP, creating a pathway for cross-origin data to be surfaced to an attacker-controlled context. Chrome's multi-process architecture normally enforces strict renderer sandbox isolation and Same-Origin Policy; this vulnerability represents a bypass of those controls specifically when the renderer is already compromised. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N confirms network-reachable exploitation requiring user interaction, high complexity (pre-compromised renderer), no privileges, and confidentiality-only impact with unchanged scope. Affected CPE is inferred from EUVD data as Chrome versions below 149.0.7827.103 on all supported desktop platforms.
RemediationAI
The primary remediation is upgrading Google Chrome to version 149.0.7827.103 or later, as confirmed by the vendor's Stable Channel Update advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html). Chrome typically auto-updates when the browser is restarted; administrators managing enterprise deployments should push the update via policy (Google Update / Chrome Browser Cloud Management) and verify version compliance. Because exploitation requires a pre-compromised renderer, organizations should also treat this as a reminder to keep Chrome up to date holistically - renderer-compromising vulnerabilities are the prerequisite here, not this CVE itself. There are no meaningful compensating controls for this specific flaw short of patching; disabling the New Tab Page is not a supported or practical option and would not constitute an approved workaround per available vendor guidance. No vendor-documented workarounds were provided in the referenced advisories.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today