EUVD-2026-40651
GHSA-f5w7-vpjf-rmjj
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page (AV:N); high complexity due to required specific UI gestures (AC:H); no attacker auth needed (PR:N); limited cross-origin data leakage only (C:L), no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's DevTools component (versions prior to 150.0.7871.47) permits a remote attacker to exfiltrate data across origin boundaries by tricking a user into performing specific UI gestures on a crafted HTML page. The CVSS base score of 3.1 (Low) reflects high attack complexity and mandatory user interaction, consistent with the EPSS score of 0.21% (11th percentile) indicating negligible in-the-wild exploitation activity. No public exploit code is identified and no CISA KEV listing exists; a vendor patch is available in Chrome 150.0.7871.47.
Technical ContextAI
The vulnerability resides in Google Chrome's DevTools subsystem - the browser-integrated developer tooling layer accessible via F12 or right-click inspection - which implements privileged access to page internals and cross-origin inspection APIs. The root cause is classified as CWE-352 (Cross-Site Request Forgery), applied here in the context of inappropriate state management or action handling within DevTools that can be abused through crafted HTML to coerce user UI gestures into triggering cross-origin data disclosure, effectively subverting the browser's Same-Origin Policy. The EUVD entry EUVD-2026-40651 and the vendor Chrome Releases advisory confirm the affected population as all Chrome stable builds prior to 150.0.7871.47. No CPE strings were supplied in the source data; the affected product is Google Chrome on all supported desktop platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later - the vendor-released patch resolving this vulnerability - available via the Chrome internal update mechanism (Settings > Help > About Google Chrome triggers an update check) or through enterprise deployment channels such as Google Admin Console or MSI packages for managed environments. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html contains release details. As a compensating control for environments that cannot immediately update, administrators can disable DevTools access entirely via Chrome enterprise policy by setting DeveloperToolsAvailability to 2 (DisableDeveloperTools); note this will break legitimate developer workflows and may affect extensions that depend on DevTools APIs. User awareness training to avoid performing unexpected UI gesture sequences prompted by untrusted web pages also reduces the social-engineering attack surface, though this is not a reliable technical control.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today