EUVD-2026-40580
GHSA-q24w-fgf9-jwgv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Privileged network position (MITM) prerequisite maps to AC:H; all other metrics align with the vendor vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a network-positioned attacker to circumvent browser-enforced navigation policies via a crafted HTML page. The attacker must occupy a privileged network position (e.g., man-in-the-middle) and requires user interaction with the malicious page, per the CVSS UI:R and the description's explicit network-position prerequisite. With an EPSS of 0.15% at the 5th percentile, no public exploit code, and no CISA KEV listing, exploitation probability is low - this is a medium-severity issue with a meaningful but situational attack barrier.
Technical ContextAI
CWE-602 (Client-Side Enforcement of Server-Side Security) identifies the root cause: Chrome's Network component enforces navigation restrictions client-side in a way that can be subverted by a sufficiently positioned adversary. Rather than server-authoritative policy enforcement, Chrome's network layer makes trust decisions that an attacker controlling or intercepting the traffic path can manipulate. The flaw resides in Chrome's desktop browser network stack, affecting all platforms running versions prior to 150.0.7871.47. The attack surface is Chrome's HTTP/HTTPS traffic handling and navigation policy evaluation when processing attacker-controlled HTML. No specific CPE string was provided in the input data, but the EUVD affected version string 'Chrome 150.0.7871.47 <150.0.7871.47' confirms the version boundary.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, available via the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users can trigger the update manually via Chrome menu > Help > About Google Chrome. Enterprise administrators should enforce the update via Chrome Browser Cloud Management or Group Policy to ensure fleet-wide remediation. As a compensating control for users who cannot immediately update and operate on untrusted or shared networks (public Wi-Fi, corporate shared segments), using a trusted VPN eliminates the attacker's privileged network position, which is the primary exploitation prerequisite - note that VPN use may introduce latency and route all traffic through the VPN provider. Blocking or restricting access from untrusted network segments to user workstations at the network layer also reduces exposure but is operationally complex in most environments.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today