EUVD-2026-50805
GHSA-hx6m-53hj-vjmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate exploit
-
DeliveryVictim visits attacker-crafted HTML page
-
ExploitPage triggers Chrome Print Preview
-
ExecutionPrint Preview fails to validate renderer-supplied input
-
PersistCross-origin data leaked to compromised renderer
-
ImpactAttacker exfiltrates sensitive cross-origin content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two cumulative conditions: first, the attacker must have already achieved code execution within Chrome's renderer process via a separate, independent vulnerability - a prerequisite not encoded in the CVSS base score but stated explicitly in the CVE description ('remote attacker who had compromised the renderer process'); second, the victim user must actively open a crafted HTML page (UI:R), triggering Print Preview. Print Preview must be accessible (default in all Chrome installations - no non-default configuration required for this component). What constrains exploitation is entirely the renderer pre-compromise requirement: without it, this vulnerability cannot be reached. SSVC confirms this is not automatable. Once renderer access is obtained, no authentication to the target system is required, and the attack is network-delivered via a crafted page. |
| Impact | The official CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) overstates ease of exploitation: AC:L does not reflect the substantial prerequisite of a prior renderer process compromise, which is a non-trivial and independently difficult condition. SSVC rates this as not automatable and partial technical impact, and EPSS at 0.29% (21st percentile) confirms low community-assessed exploitation probability. There is no CISA KEV listing and no public POC. The realistic risk profile is of a chained, targeted attack - an attacker who has already obtained renderer code execution seeking an additional information-disclosure primitive rather than a standalone critical exploit. Impact is limited to confidentiality (no integrity or availability); cross-origin data exposure could be significant (session tokens, user data) but requires a sophisticated two-stage exploit chain. This vulnerability should be patched on schedule but does not warrant emergency response absent confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker who has separately compromised Chrome's renderer process - via an initial renderer vulnerability - then serves the victim a crafted HTML page designed to trigger Print Preview processing. The insufficient validation in Print Preview allows the already-compromised renderer to read and exfiltrate cross-origin data (such as authentication tokens or page content from other open origins) back to the attacker. No public proof-of-concept exists; this scenario requires chaining a renderer exploit with this information-disclosure primitive, limiting realistic threat actors to those with significant capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, available via Chrome's built-in auto-update mechanism or directly from the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. This patch addresses the insufficient input validation in the Print Preview component. For enterprise environments unable to immediately deploy the update, the PrintingEnabled Chrome policy can be set to false to disable Print Preview entirely, eliminating this attack surface at the cost of all in-browser printing capability. No other confirmed workaround fully mitigates the vulnerability without patching. Organizations relying on extended support channels should verify whether their managed Chrome version includes this fix independently.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Print Preview subsystem, affecting all versions across all platforms (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The root cause is CWE-20 (Improper Input Validation): the Print Preview component fails to sufficiently validate untrusted input originating from a compromised renderer process, allowing that compromised renderer to access and leak data governed by the Same-Origin Policy. Chrome's multi-process security architecture is designed to sandbox renderer processes, with the browser process acting as a privilege boundary enforcer; this flaw represents a partial bypass of that cross-origin isolation when Print Preview handles renderer-supplied content, enabling leakage of data (cookies, tokens, page content) from origins other than the attacker-controlled page.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Renderer pre-compromise is a non-trivial, explicit prerequisite justifying AC:H; confidentiality impact only, no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB