EUVD-2026-40641
GHSA-hwcx-qm5w-p7p3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H captures the mandatory renderer-compromise chaining prerequisite omitted by the NVD-assigned AC:L; all other metrics follow the supplied vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome's SplitView feature (prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to escape navigation controls via a crafted HTML page. The CWE-284 (Improper Access Control) root cause means Chrome's SplitView fails to enforce navigation policy in a post-renderer-compromise context, making this a chained exploit component rather than a standalone initial-access vector. EPSS is very low (0.22%, 13th percentile), no public exploit code has been identified, and SSVC rates exploitation as none with partial technical impact at time of analysis.
Technical ContextAI
Chrome's SplitView is a browser UI component for displaying web content in split or multi-pane configurations. The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the SplitView implementation fails to properly enforce access control decisions - specifically navigation restrictions that prevent a renderer from navigating to arbitrary origins or bypassing same-origin and navigation policy boundaries. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Google Chrome across all operating systems. In Chrome's multi-process architecture, the renderer process handles web content but is sandboxed; navigation restrictions are enforced both at the browser process level and within renderer-facing APIs. An inappropriate implementation in SplitView appears to allow a compromised renderer to trigger navigation actions that should be blocked, consistent with the broader class of renderer-side policy enforcement failures.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability per the stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators should deploy the update via Chrome Browser Cloud Management or group policy to ensure managed endpoints are covered. Where immediate patching is constrained, restricting use of Chrome's SplitView feature via enterprise policy (if a SplitViewEnabled policy is available in the deployed version) may reduce exposure, though this has not been independently confirmed as a complete mitigation. Because exploitation requires prior renderer process compromise as a chained prerequisite, prioritizing patching of other Chrome vulnerabilities that enable renderer-level code execution - particularly V8 engine issues - will also limit the viability of this attack chain.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today