EUVD-2026-37538Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
AC:H reflects the mandatory renderer pre-compromise; UI:R for required victim page visit; C:L/I:L for SOP bypass impact limited to cross-origin content; no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Same-origin policy bypass in Google Chrome prior to 149.0.7827.155 enables a remote attacker who has already compromised the renderer process to read or modify cross-origin content via a crafted HTML page. The flaw resides in Chrome's Input component, where insufficient validation of untrusted input fails to enforce origin boundaries under this post-compromise condition. No public exploit code or active exploitation has been identified; EPSS places this at the 20th percentile with a 0.29% probability of exploitation, and CISA SSVC rates technical impact as partial with no automatable path.
Technical ContextAI
The vulnerability affects Google Chrome's Input handling subsystem (CWE-20: Improper Input Validation), which processes untrusted data received by the renderer process. Chrome's multi-process architecture isolates web content in sandboxed renderer processes; the same-origin policy (SOP) enforced within this layer prevents cross-origin data access. When input validation is insufficient, an attacker operating inside a compromised renderer can submit crafted inputs that circumvent the SOP check, collapsing the cross-origin trust boundary. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all builds prior to 149.0.7827.155 across platforms (noted in tags as affecting Red Hat and SUSE package distributions as well). The EUVD affected range is confirmed as Chrome versions below 149.0.7827.155.
RemediationAI
The primary fix is to upgrade Google Chrome to version 149.0.7827.155 or later; this is a vendor-released patch confirmed via the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome's auto-update mechanism should deliver this automatically on managed and consumer endpoints; administrators should verify rollout completion via endpoint management tooling. For Red Hat and SUSE deployments, apply the corresponding vendor-released package update once available through their advisory channels. Because exploitation requires a prior renderer compromise, reducing exposure to renderer-targeting vulnerabilities (e.g., enforcing Chrome's site isolation and sandboxing features, restricting access to malicious or untrusted web content via proxy filtering) serves as a complementary control but is not a substitute for patching. No workaround eliminates the SOP bypass without the patch.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today