EUVD-2026-40619
GHSA-88gx-5wm5-m35h
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N for network-delivered crafted HTML; AC:H because renderer compromise is a mandatory prerequisite; UI:R for required victim navigation; C:H for potential full credential exposure; no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Insufficient policy enforcement in Chrome's built-in Passwords subsystem (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to read potentially sensitive credential data from process memory via a crafted HTML page. This is a second-stage, chained information-disclosure flaw - not a standalone exploit - that bypasses Chrome's inter-process access boundaries to reach password manager data. No public exploit code has been identified at time of analysis, and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Technical ContextAI
Chrome's security architecture enforces strict process isolation: the renderer process (which parses and executes web content) is intentionally sandboxed and denied access to privileged browser-process data such as stored credentials. The vulnerable component is Chrome's built-in password manager ('Passwords' subsystem), which stores and autofills user credentials. CWE-284 (Improper Access Control) identifies the root cause as a failure to enforce the intended policy boundary - specifically, the renderer process is able to access or probe memory regions belonging to the Passwords subsystem that it should be categorically denied. The AV:N/UI:R CVSS metrics confirm the attack is delivered via the network through a crafted HTML page that the victim must visit, but AC:H signals that exploitation depends on a pre-existing renderer-level compromise, consistent with a sandbox-escape or inter-process privilege escalation pattern common to Chromium vulnerability chains.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later - this is the confirmed vendor-released patch per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users can update via Help > About Google Chrome; enterprise administrators should push the update through their management platform (e.g., Google Admin, Intune, or SCCM). As an interim compensating control in high-security environments, organizations may disable Chrome's built-in password manager via enterprise policy (PasswordManagerEnabled=false) and migrate credential storage to a dedicated password manager - note this will remove autofill functionality and may disrupt user workflows. Additionally, restricting outbound web access from endpoints running unpatched Chrome versions (particularly to untrusted or external sites) reduces the attack surface for the initial renderer-level exploit that this CVE depends upon.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today