EUVD-2026-50792
GHSA-cqjx-gwfh-qhm2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires an attacker-in-the-middle privileged network position, so AC:H rather than the vendor's AC:L; no auth or interaction needed (PR:N/UI:N); high confidentiality and integrity impact but no availability effect (A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)
AnalysisAI
Discretionary access control bypass in Google Chrome desktop before 151.0.7922.72 lets an adversary in a privileged network position defeat a cryptographic protection and manipulate protected traffic. The flaw stems from a cryptographic weakness (CWE-325) rather than a memory-safety bug, and Google rates the Chromium severity High. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a privileged (on-path / adversary-in-the-middle) network position relative to the victim's Chrome traffic - e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and should be read together. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who controls a segment of the victim's network path - for example a rogue access point, a compromised router, or an ARP-spoofing foothold on a shared LAN - intercepts Chrome's protected traffic and exploits the missing cryptographic step to bypass discretionary access control, reading or altering data the control was meant to protect. No user interaction or credentials are required beyond the attacker's network position. … |
| Remediation | Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and use enterprise policies (Chrome Enterprise/managed update servers) to force the rollout across fleets. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Chrome desktop deployments and document version numbers to baseline exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-325 – Missing Cryptographic Step
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today