EUVD-2026-50832
GHSA-5ggp-m8m8-wmgj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics align with vendor vector as delivery, impact scope, and user interaction are accurately characterized.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be satisfied: first, the attacker must have already compromised the Chrome renderer process on a Windows host via a separate, independent vulnerability - this is a non-trivial and independently complex precondition; second, the victim must visit or be redirected to a crafted HTML page under attacker control, requiring active user interaction (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) likely understates practical attack complexity: AC:L does not capture the mandatory renderer-compromise prerequisite, which itself typically requires exploiting a separate, independent vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already achieved code execution within a Chrome renderer process on Windows - via a separate renderer bug - serves the victim a crafted HTML page embedding malicious media content targeting the Media component's validation flaw. The insufficient input validation allows the compromised renderer to read data from a cross-origin resource loaded in the victim's browser session, such as authentication tokens or sensitive page content from a co-loaded origin. … |
| Remediation | Upgrade Google Chrome on Windows to version 151.0.7922.72 or later, the patched release confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today