EUVD-2026-40737
GHSA-2pj2-8f73-8vw2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
C downgraded from H to L to reconcile Chromium's own Low severity rating, implying limited data exposure scope rather than full credential disclosure.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Passwords component prior to version 150.0.7871.47 enables remote attackers to exfiltrate credential-related or other sensitive cross-origin data by directing victims to a crafted HTML page. The root cause (CWE-693, Protection Mechanism Failure) represents a breakdown in the policy enforcement layer governing cross-origin access in the Passwords subsystem - a bypass of the isolation guarantees Chrome's same-origin model is meant to provide. No public exploit has been identified at time of analysis; EPSS of 0.17% (7th percentile) and the absence of a CISA KEV listing place real-world exploitation probability very low, and Chromium's own team rated the severity as Low despite the NVD CVSS 6.5 Medium score.
Technical ContextAI
The vulnerability resides in the Passwords subsystem of the Chromium browser engine, which manages saved credentials and interacts closely with renderer-side web content. CWE-693 (Protection Mechanism Failure) indicates that a protection mechanism - specifically the policy controls that enforce cross-origin isolation in this subsystem - was not applied correctly, rather than being absent entirely. Chrome relies on the Same-Origin Policy (SOP) and related enforcement layers to prevent one origin from reading data belonging to another; a failure in this enforcement within the Passwords component can permit a crafted page to read or infer data that should be restricted to a different origin. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms the attack surface is network-reachable and requires no attacker-side privileges, but depends on a user visiting the malicious page. No CPE string was provided in the source data; the affected product is identified as Google Chrome stable channel prior to 150.0.7871.47 across all desktop platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later immediately via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or by downloading directly from the stable channel release noted at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Patch availability is confirmed per vendor advisory; version 150.0.7871.47 is the explicit fix version. As a compensating control in managed environments where patching cannot be applied immediately, administrators can disable Chrome's built-in Passwords feature via Group Policy (set PasswordManagerEnabled to false), which removes the vulnerable subsystem's interaction with web content - the trade-off is loss of the native credential manager for all users. URL filtering to block access to untrusted external sites can reduce exposure but does not eliminate risk from compromised or attacker-controlled pages that users may legitimately visit.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today