EUVD-2026-40752
GHSA-w6vr-48rr-ggrr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Renderer-compromise prerequisite elevates AC to H; no system auth required (PR:N); user must visit crafted page (UI:R); integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables attackers who have already achieved renderer process compromise to escape certain navigation-level security controls via a crafted HTML page. The flaw resides in the PageInfo component, which handles page metadata, security indicators, and related navigation policy enforcement, and fails to adequately validate attacker-controlled input passed from a compromised renderer. With an EPSS of 0.22% (13th percentile), no CISA KEV listing, and a Chromium-internal severity of Low, real-world exploitation risk is currently low despite the CVSS 6.5 medium rating.
Technical ContextAI
Google Chrome employs a multi-process architecture in which web content is rendered inside a sandboxed renderer process isolated from the browser process. The PageInfo subsystem resides in the browser process and is responsible for aggregating and displaying page security details - including SSL certificate status, permissions, and origin information - while also enforcing related navigation policies. CWE-20 (Improper Input Validation) identifies the root cause: the PageInfo component does not sufficiently validate input originating from the renderer process, allowing a renderer that has been compromised through a separate vulnerability to supply crafted input that manipulates navigation restriction logic. This makes CVE-2026-14065 a second-stage exploit primitive rather than a standalone entry point - it presupposes that the renderer sandbox has already been breached. Affected versions span all Chrome desktop releases prior to 150.0.7871.47, as confirmed by the EUVD range entry and the Google Stable Channel advisory.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later - this is the vendor-confirmed fixed release per the Stable Channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates are the primary delivery mechanism; administrators managing enterprise deployments should verify update propagation via the Chrome Browser Cloud Management console or equivalent MDM tooling. As a compensating control prior to patching, enterprise policies can be applied to block navigation to untrusted or external origins using Chrome's URLBlocklist policy, though this carries significant usability trade-offs and does not eliminate the renderer-compromise prerequisite that is the true entry point. Because this vulnerability requires renderer compromise as a prerequisite, prioritizing patching of higher-severity renderer-targeted Chrome vulnerabilities in parallel will reduce the practical attack surface more broadly.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today