EUVD-2026-40740
GHSA-f2vr-9qrm-hv28
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Renderer-process-compromise prerequisite explicitly stated in description elevates effective complexity to AC:H; remaining metrics align with the vendor-provided vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 150.0.7871.47) enables a remote attacker - who has first achieved renderer process compromise - to bypass same-origin policy enforcement and read cross-origin data via a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error) and rated Low severity by the Chromium security team. EPSS is extremely low at 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, consistent with the significant chained exploitation barrier imposed by the renderer-compromise prerequisite.
Technical ContextAI
The vulnerability resides in Chrome's Extensions subsystem, which mediates policy enforcement between browser extensions and web content - including enforcement of the Same-Origin Policy (SOP) and cross-origin resource sharing (CORS) boundaries. CWE-346 (Origin Validation Error) identifies the root cause as a failure to adequately validate or restrict the origin of data accessed through the Extensions layer, allowing cross-origin reads that should be prohibited. The affected product per EUVD CPE data is Google Chrome prior to version 150.0.7871.47 across all supported desktop platforms (Windows, macOS, Linux). Chrome's multi-process architecture is relevant here: the renderer process handles untrusted web content in a sandboxed context, and the Extensions subsystem bridges renderer-side and browser-side privileges - making policy enforcement gaps in this layer particularly sensitive when the renderer is adversarially controlled.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released fix per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; administrators managing enterprise deployments should confirm propagation via Chrome Browser Cloud Management or group policy version enforcement. No official workaround is documented. As compensating controls, ensuring Chrome's Site Isolation is fully enabled (the default in modern Chrome builds) reduces the blast radius of any renderer-compromise precursor, limiting cross-site data access even if a renderer is exploited. Restricting the installation of untrusted or unreviewed extensions via enterprise policy (ExtensionInstallAllowlist) can reduce the Extensions attack surface, though it does not directly block this vulnerability.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today