EUVD-2026-50826
GHSA-9vrw-vg3x-9vqg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted HTML page to victim
-
DeliveryTrigger separate renderer process compromise
-
ExploitInvoke Actor component with malicious untrusted input
-
ExecutionBypass cross-origin input validation
-
ImpactLeak cross-origin data to attacker-controlled renderer
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two explicit preconditions: (1) the victim must visit or be redirected to a crafted HTML page (user interaction required, per UI:R in the CVSS vector), and (2) the attacker must have already compromised the Chrome renderer process through a separate, independent vulnerability - this prerequisite is explicitly stated in the CVE description and is the primary limiting factor on real-world exploitability. Without prior renderer compromise, this vulnerability cannot be triggered. The flaw is platform-agnostic across Chrome desktop deployments on Windows, macOS, and Linux. No special non-default Chrome configuration is required beyond the renderer being compromised; however, the renderer compromise itself represents a significant attack prerequisite that limits this to sophisticated, multi-stage threat actors. |
| Impact | The official CVSS 3.1 score of 4.3 (Medium) correctly reflects limited impact: C:L (partial confidentiality breach), I:N, A:N, with UI:R requiring user interaction. However, the PR:N designation in the official vector is potentially misleading - the CVE description explicitly states that exploitation requires the renderer process to have already been compromised, which in practice makes this a multi-stage attack requiring a separate renderer exploit as a prerequisite. EPSS of 0.29% at the 21st percentile strongly aligns with low exploitation probability, and the absence of both a KEV listing and any identified POC reinforces this. Real-world risk is primarily to users already targeted by sophisticated multi-vulnerability attack chains; this CVE alone does not constitute an independent high-priority threat for most organizations. The CVSS score slightly overstates autonomous exploitability by not reflecting the renderer compromise requirement in attack complexity. |
| Exploit ScenarioDerived | An attacker who has already achieved renderer process compromise in Chrome - through a separate, chained renderer vulnerability - directs the victim to a specially crafted HTML page. The page triggers the flawed Actor component with malicious untrusted input that bypasses cross-origin validation, leaking sensitive data (such as authentication tokens or page content from another origin loaded in the browser) back to the attacker-controlled renderer context. This provides the attacker with cross-origin data they would not otherwise be able to access, advancing a broader attack chain against the victim's browser session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism should deliver this patch; users and administrators should confirm the installed version via chrome://settings/help. Enterprise fleet administrators should expedite deployment through the Google Admin console or Group Policy update tooling. No standalone workaround fully mitigates this flaw without patching, since the Actor component is integral to the browser. As a general defense-in-depth measure, ensuring Chrome's Site Isolation feature remains enabled (chrome://flags/#site-isolation-trial-opt-out) reduces the blast radius of renderer compromise scenarios that this vulnerability builds upon, but does not address the Actor validation flaw directly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the 'Actor' component of Chromium's rendering engine, which implements a concurrency and message-passing abstraction used internally within the browser process. CWE-20 (Improper Input Validation) identifies the root cause: the Actor fails to sufficiently validate untrusted input passed into it from a compromised renderer context, allowing that input to influence cross-origin data access in violation of the Same-Origin Policy. Chrome's multi-process sandbox architecture is designed so that a compromised renderer cannot read data from other origins; this flaw represents a post-renderer-compromise escalation path within that architecture. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop versions on all platforms prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Renderer process compromise is an explicit prerequisite, raising real-world attack complexity to High; impact limited to partial cross-origin confidentiality disclosure only.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB