EUVD-2026-50788
GHSA-wm9r-82qw-cfp5
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring active user visit (UI:R); impact is cross-origin data leakage only (C:L), no integrity or availability effect, no scope change.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.
Technical ContextAI
The vulnerability resides in Chrome's Prefetch feature, a browser performance optimisation that speculatively fetches resources anticipated to be needed during future navigations. CWE-346 (Origin Validation Error) identifies the root cause class: the prefetch subsystem fails to enforce same-origin policy or equivalent Cross-Origin Resource Policy (CORP) controls consistently, allowing policy-violating cross-origin reads to be triggered and their results inferred by the initiating page. The affected product is Google Chrome across all versions prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The specific Chromium issue is tracked at https://issues.chromium.org/issues/497491557, though the details may be access-restricted pending broader patch adoption. This class of browser-side origin enforcement failures can expose session-dependent resources, authentication tokens embedded in pages, or personalised content served by cross-origin sites the victim is concurrently authenticated to.
RemediationAI
The primary and definitive fix is to update Google Chrome to version 151.0.7922.72 or later via Chrome's built-in silent updater or by deploying the updated installer through enterprise software management tooling; the vendor advisory is available at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments where immediate patching is infeasible, administrators can deploy the Chrome enterprise policy PrefetchEnabled=false (or NetworkPredictionOptions set to 2) to disable prefetch entirely - this eliminates the vulnerable code path at the cost of reduced speculative navigation performance and higher perceived page load latency. Restricting employee browsing to allowlisted domains via a web proxy further reduces attack surface by limiting attacker-controlled page delivery. Generic 'defence in depth' measures such as Safe Browsing do not mitigate the underlying origin enforcement flaw and should not be treated as substitutes for patching.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today