EUVD-2026-50800
GHSA-g2wc-g6r3-6429
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker crafts malicious HTML page
-
DeliveryHosts page on attacker-controlled or compromised site
-
ExploitLures victim via phishing or malvertising
-
InstallVictim opens page in unpatched Chrome
-
C2HTML engine fails to enforce CSP directives
-
ExecuteUnauthorized scripts execute in browser context
-
ImpactIntegrity violation or data exfiltration within session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | The victim must use Google Chrome prior to version 151.0.7922.72 and actively visit a crafted HTML page - user interaction (UI:R) is a hard prerequisite that rules out fully automated mass exploitation or server-side attack paths. No special server-side configuration is required; the flaw is triggered entirely client-side by the specific HTML content served by the attacker. The CVSS PR:N metric confirms no attacker-side authentication or privileges are needed. Exploitation is concretely limited by: (1) mandatory user navigation to an attacker-controlled or compromised page via social engineering; (2) the vulnerability is scoped to Chrome desktop - mobile Chrome and non-Chromium browsers are not confirmed affected. The absence of a public POC further constrains opportunistic exploitation to threat actors capable of independently reproducing the triggering HTML pattern. |
| Impact | The NVD CVSS 3.1 score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-accessible, low-complexity attack requiring only user interaction - consistent with a browser-based drive-by exploitation model. Integrity impact is rated High, as a successful CSP bypass permits unauthorized script execution or content injection within the victim's browser context. However, real-world exploitation signals are weak: EPSS is 0.30% at the 23rd percentile, no active exploitation is confirmed (not listed in CISA KEV), and no public POC has been identified. The mandatory user interaction (UI:R) further limits mass automated exploitation. The primary risk is targeted social engineering scenarios where a victim is directed to a malicious page. Despite Chrome's ubiquitous deployment, the combination of low EPSS, no KEV listing, and UI:R requirement suggests this is a genuine medium-priority patch item rather than an emergency response for most organizations. The unchanged scope (S:U) means exploitation is contained within the browser session and does not directly escalate to OS-level compromise. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page containing specific HTML constructs that trigger Chrome's CSP enforcement failure, then lures a victim to visit the page via phishing, malvertising, or a compromised third-party website. Once Chrome renders the page, the CSP policy intended to block unauthorized script sources is silently bypassed, allowing attacker-controlled scripts to execute within the page context. No public exploit code has been identified at time of analysis, so exploitation currently likely requires independent discovery of the precise triggering HTML pattern. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. No public exploit code has been identified and EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation probability despite Chrome's ubiquitous deployment footprint.
RemediationAI
The vendor-released patch is Chrome 151.0.7922.72, available via Chrome's built-in auto-update mechanism or through the Chrome menu under Help > About Google Chrome. Users and administrators should verify the installed version reaches at least 151.0.7922.72 by navigating to chrome://settings/help. The full release advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the upstream Chromium issue is tracked at https://issues.chromium.org/issues/513791232. For enterprise environments where immediate patching is constrained, enabling CSP violation reporting endpoints (report-uri or report-to directives) can provide detection coverage, though this does not prevent the bypass itself. Organizations that rely on CSP as a primary XSS mitigation layer should treat this patch with heightened urgency relative to the low EPSS score, since a CSP bypass directly neutralizes that control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google Chrome's HTML rendering engine contains a logic flaw (CWE-693: Protection Mechanism Failure) in how it processes certain HTML constructs, causing the browser's Content Security Policy enforcement to be bypassed. CSP is a browser-enforced security layer that restricts sources of executable scripts, styles, and other resources - a bypass undermines this entire defense layer, potentially enabling cross-site scripting or unauthorized resource loading even on sites that have correctly deployed CSP headers. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 151.0.7922.72 across desktop platforms. The ENISA EUVD entry (EUVD-2026-50800) corroborates the affected version range. Note: the 'Authentication Bypass' tag present in the intelligence feed appears to be a misclassification - the described mechanism is a protection-mechanism bypass (CSP), not an authentication bypass, and CWE-693 confirms this.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page, no attacker privileges needed, active user visit required (UI:R), integrity-only impact as CSP bypass enables unauthorized script execution with no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB