EUVD-2026-50826
GHSA-9vrw-vg3x-9vqg
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Renderer process compromise is an explicit prerequisite, raising real-world attack complexity to High; impact limited to partial cross-origin confidentiality disclosure only.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.
Technical ContextAI
The vulnerability resides in the 'Actor' component of Chromium's rendering engine, which implements a concurrency and message-passing abstraction used internally within the browser process. CWE-20 (Improper Input Validation) identifies the root cause: the Actor fails to sufficiently validate untrusted input passed into it from a compromised renderer context, allowing that input to influence cross-origin data access in violation of the Same-Origin Policy. Chrome's multi-process sandbox architecture is designed so that a compromised renderer cannot read data from other origins; this flaw represents a post-renderer-compromise escalation path within that architecture. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop versions on all platforms prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism should deliver this patch; users and administrators should confirm the installed version via chrome://settings/help. Enterprise fleet administrators should expedite deployment through the Google Admin console or Group Policy update tooling. No standalone workaround fully mitigates this flaw without patching, since the Actor component is integral to the browser. As a general defense-in-depth measure, ensuring Chrome's Site Isolation feature remains enabled (chrome://flags/#site-isolation-trial-opt-out) reduces the blast radius of renderer compromise scenarios that this vulnerability builds upon, but does not address the Actor validation flaw directly.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today