EUVD-2026-40616
GHSA-5rqg-9mjf-c7j6
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted HTML page requires no attacker auth (PR:N) but mandates victim interaction (UI:R); integrity-only impact reflects navigation policy bypass with no data disclosure or availability loss.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to version 150.0.7871.47 enables remote attackers to circumvent browser policy enforcement via a crafted HTML page targeting the 'Actor' component. The flaw is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), where controls that should be authoritative are applied within the browser and can be subverted by an adversary-controlled page. EPSS at 0.22% (13th percentile) indicates low current exploitation probability, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV; no public exploit identified at time of analysis.
Technical ContextAI
CWE-602 (Client-Side Enforcement of Server-Side Security) describes a class of flaws where security-critical policy decisions are applied within the client - in this case inside Chrome's 'Actor' component - rather than being enforced by an authoritative, tamper-resistant layer. The Chromium 'Actor' component is part of the browser's internal permission and navigation policy model, governing how frames and pages may initiate or influence navigations. When enforcement is insufficient, a malicious HTML page can craft interactions with this component to trigger navigations that should be blocked by origin policies, site isolation rules, or other navigation restrictions. The affected product range covers Google Chrome desktop (Windows, macOS, Linux) across all versions below 150.0.7871.47, as confirmed by the EUVD entry EUVD-2026-40616. No CPE string was included in the source intelligence; affected scope is inferred from the Chrome Releases advisory and EUVD version data.
RemediationAI
The primary remediation is upgrading Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch as confirmed by the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates for most consumer deployments; enterprise administrators should verify patch application across managed endpoints via their browser management platform (e.g., Google Admin Console, Intune, or equivalent). As a compensating control for environments where immediate patching is not feasible, restrict outbound browsing to an allowlisted set of trusted domains via enterprise browser policy - this reduces exposure to adversary-hosted crafted pages but may disrupt legitimate web access and requires careful allowlist management. Additionally, web proxies or DNS filtering solutions configured to block access to untrusted or newly-registered domains can reduce the likelihood of users reaching exploit pages, though these controls do not remediate the underlying flaw.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today