EUVD-2026-50819
GHSA-9xqg-8hc3-vfpq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page on controlled domain
-
DeliveryVictim navigates to malicious URL in unpatched Chrome
-
ExploitPage invokes FileSystem API with insufficient origin enforcement
-
ExecutionCross-origin data boundary bypassed
-
PersistSensitive origin-scoped data read by attacker page
-
ImpactExfiltrated to attacker-controlled server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | The victim must be running Google Chrome on desktop at any version prior to 151.0.7922.72, and must visit an attacker-crafted HTML page - no download or file execution is required beyond normal browser navigation. Per the CVSS vector (PR:N, UI:R), no authentication or elevated privileges are needed by the attacker, but the attack cannot proceed without the victim actively loading the malicious page. Exploitation is constrained to the confidentiality dimension: the attacker can leak cross-origin data but cannot modify data or cause a crash. The vulnerability is not exploitable against users who have applied the 151.0.7922.72 stable update, and server-side configurations are irrelevant - the flaw is entirely within the browser client. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) reflects the constrained impact profile: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The attack is network-reachable with no privilege requirement and low complexity, but mandates user interaction - the victim must visit the attacker-controlled page - and the confidentiality impact is rated Low (partial data exposure rather than full compromise). EPSS at 0.29% (21st percentile) independently corroborates low mass-exploitation probability. There is no CISA KEV listing and no known public PoC, keeping exploitation in the realm of opportunistic or targeted threat actors rather than commodity campaigns. The primary real-world concern is phishing-delivered pages targeting high-value users who store sensitive data in Chrome's FileSystem-backed storage. Despite the modest CVSS score, Chrome's ubiquitous presence means the raw number of potentially exposed endpoints is enormous, making timely patching strategically important even if individual exploitation risk per endpoint is low. |
| Exploit ScenarioDerived | An attacker registers a domain and hosts a crafted HTML page that exploits the FileSystem origin-validation gap in Chrome. A victim running an unpatched Chrome version is directed to the page via a phishing email or malicious advertisement; upon loading, the page reads FileSystem-stored data belonging to a different origin - such as credentials or tokens cached by a web application - and transmits it to an attacker-controlled server. No public PoC is currently known, so exploitation at this stage is likely limited to sophisticated actors with knowledge of the Chromium internals. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later via the built-in auto-update mechanism or the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Auto-update is enabled by default for most Chrome installations and will apply the fix without manual intervention; enterprise deployments using Google Update or third-party patch management should verify rollout completion. If immediate patching is not possible, organizations can apply Chrome enterprise policies to restrict navigation to untrusted external websites, reducing exposure to attacker-hosted crafted pages - this limits functionality and may affect productivity. Disabling the FileSystem API via enterprise policy (if supported and not business-critical) would eliminate the attack surface entirely but would break any web applications relying on origin-private file storage. No patch version other than 151.0.7922.72 is independently confirmed at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Google Chrome's FileSystem API implementation - either the legacy File System API or the modern File System Access API - which allows web content to interact with origin-scoped storage. CWE-346 (Origin Validation Error) indicates that the enforcement of same-origin policy within the FileSystem subsystem is incomplete, permitting a crafted page to read or infer data belonging to a different origin. Same-origin policy is a foundational browser security boundary; failures here undermine the isolation guarantees that prevent cross-site data theft. The affected product is Google Chrome across all versions prior to 151.0.7922.72 on desktop platforms, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The Chromium bug tracker entry (issues.chromium.org/issues/517448723) contains additional technical detail under restricted access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L, PR:N); victim must visit attacker URL (UI:R); limited to partial cross-origin data read with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB