EUVD-2026-40707
GHSA-qxj7-7wh4-c9pf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-accessible with no privileges required; mandatory user page visit is the sole barrier; confidentiality impact is high due to credential data exposure with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin credential data leakage in Google Chrome's built-in Passwords feature (all versions prior to 150.0.7871.47) can be triggered remotely via a crafted HTML page requiring only user interaction. The flaw is rooted in an inappropriate implementation in Chrome's password management subsystem (CWE-522 - Insufficiently Protected Credentials), allowing a remote attacker to read data across origin boundaries that should be strictly isolated. No public exploit code is identified and EPSS stands at 0.17% (7th percentile), indicating limited exploitation pressure at time of analysis; however, Chrome's ubiquitous deployment makes the aggregate exposure significant.
Technical ContextAI
CWE-522 (Insufficiently Protected Credentials) classifies vulnerabilities where credential data is not adequately protected from unauthorized access - in this case, Chrome's password manager subsystem fails to enforce same-origin policy boundaries correctly, permitting a crafted page to read cross-origin data associated with the Passwords feature. The flaw resides in the Chromium rendering engine's implementation of the password management API, which interacts with stored credentials during page rendering. Per EUVD data, the affected product range is Google Chrome desktop versions below 150.0.7871.47. The Chromium issue tracker (issues.chromium.org/issues/517455455) provides the upstream defect record. The 'inappropriate implementation' classification used by Google's security team suggests a logic or policy enforcement error rather than a classic memory corruption vulnerability.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, as confirmed by the vendor stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on supported desktop platforms updates automatically; users should verify currency by navigating to chrome://settings/help and triggering a manual check. As a compensating control for environments where patching is delayed, administrators or users can disable the Chrome built-in password manager via Settings > Autofill and passwords > Google Password Manager > toggle off 'Offer to save passwords' - this eliminates the vulnerable component's exposure but forces reliance on a standalone password manager, adding workflow friction. Organizations managing Chrome via policy can enforce password manager disablement using the PasswordManagerEnabled policy set to false, with no impact on browser core functionality.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today