EUVD-2026-40779
GHSA-jhfh-9hjr-wg99
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the privileged network position prerequisite (on-path MITM); all other metrics align with the provided vector - PR:N, UI:R, C:L only.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 enables an on-path network adversary to bypass Chrome's privacy policy enforcement and observe data belonging to a different origin via crafted malicious network traffic. The flaw is classified as CWE-693 (Protection Mechanism Failure), indicating Chrome's privacy isolation layer fails to correctly enforce cross-origin restrictions under certain network conditions. EPSS sits at 0.11% (2nd percentile), no public exploit code is known, and the vulnerability has not been added to CISA KEV; Chromium itself rates this Low severity.
Technical ContextAI
CWE-693 (Protection Mechanism Failure) describes a failure to correctly apply a security mechanism that was intended to prevent unauthorized access or data leakage. In this instance, the affected component is Chrome's 'Privacy' subsystem, which encompasses policies such as Private Network Access restrictions, referrer policy enforcement, cross-origin resource isolation, and related same-origin policy derivatives. Google Chrome's security model depends heavily on correct enforcement of these boundaries to prevent one origin from observing data destined for or originating from another. The CVSS vector (AV:N) confirms the attack is fully network-routed, and S:U (Unchanged scope) indicates the impact is confined to the victim's browsing session. The affected version range per EUVD data is all Chrome releases below 150.0.7871.47 across all platforms where Chrome is distributed.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which is confirmed as the vendor-released patch per the Google Chrome Stable Channel Update advisory at chromereleases.googleblog.com. Chrome's built-in auto-update mechanism will deliver this silently for most users; enterprise administrators managing Chrome via policy should verify fleet versions using Chrome Browser Cloud Management or equivalent tooling. For users who cannot immediately update and operate in high-risk network environments (untrusted Wi-Fi, shared corporate infrastructure), a compensating control is to route Chrome traffic through a trusted VPN, which removes the attacker's privileged network position and prevents the on-path manipulation required to trigger the flaw - note this adds latency and may affect split-tunnel configurations. Disabling specific Chrome Privacy-related features is not a practical workaround given the lack of detailed root-cause disclosure in the advisory. Tracking issue https://issues.chromium.org/issues/513212892 may provide additional technical detail as it becomes public.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today