EUVD-2026-50832
GHSA-5ggp-m8m8-wmgj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit separate Chrome renderer bug on Windows
-
DeliveryGain renderer process execution
-
ExploitDeliver crafted HTML page with malicious media
-
ExecutionTrigger insufficient input validation in Media component
-
PersistRead cross-origin data accessible to victim browser
-
ImpactExfiltrate sensitive cross-origin content to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Two concrete prerequisites must both be satisfied: first, the attacker must have already compromised the Chrome renderer process on a Windows host via a separate, independent vulnerability - this is a non-trivial and independently complex precondition; second, the victim must visit or be redirected to a crafted HTML page under attacker control, requiring active user interaction (UI:R). The vulnerability is Windows-specific and does not affect Chrome on any other platform. No system-level credentials or privileges beyond renderer access are required. The primary limiting factors are the mandatory renderer pre-compromise step and user interaction, which together restrict exploitation to sophisticated targeted attacks; automated or opportunistic exploitation is implausible given these prerequisites. |
| Impact | The vendor-assigned CVSS of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) likely understates practical attack complexity: AC:L does not capture the mandatory renderer-compromise prerequisite, which itself typically requires exploiting a separate, independent vulnerability. EPSS at 0.29% (21st percentile) is low and consistent with a multi-stage exploitation path that limits threat actor reach. The vulnerability is absent from CISA KEV and no public proof-of-concept exists at time of analysis. Windows-only scope further narrows exposure. In aggregate, real-world risk is concentrated among sophisticated, targeted attackers capable of chaining two Chrome exploits - not opportunistic or automated attackers. Security teams in sensitive sectors (finance, government, critical infrastructure) running unpatched Chrome on Windows should treat this as a meaningful second-stage risk in a chain; others can treat patching as routine maintenance. |
| Exploit ScenarioDerived | An attacker who has already achieved code execution within a Chrome renderer process on Windows - via a separate renderer bug - serves the victim a crafted HTML page embedding malicious media content targeting the Media component's validation flaw. The insufficient input validation allows the compromised renderer to read data from a cross-origin resource loaded in the victim's browser session, such as authentication tokens or sensitive page content from a co-loaded origin. No public proof-of-concept exists, limiting realistic exploitation to threat actors capable of constructing a two-stage Chrome exploit chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
RemediationAI
Upgrade Google Chrome on Windows to version 151.0.7922.72 or later, the patched release confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in update mechanism will deliver this automatically; enterprise administrators should verify deployment via Group Policy (ChromeVersion policy) or their MDM solution and confirm no managed endpoints are pinned to older channel versions. As a compensating control pending patch rollout, restricting user access to untrusted external sites via web proxy allowlists reduces the attacker's HTML delivery surface, though it does not address the underlying flaw. Chrome's Site Isolation feature (enabled by default) provides partial defense-in-depth against cross-origin leakage but is not a substitute for patching given this vulnerability specifically bypasses Media component validation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Media component of Google Chrome on Windows, as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root cause class is CWE-20 (Improper Input Validation): the Media subsystem fails to adequately validate untrusted inputs supplied via crafted HTML, allowing that data to cross origin boundaries that the Same-Origin Policy should enforce. Chromium's multi-process architecture sandboxes renderer processes, but this vulnerability assumes renderer process compromise has already occurred - the Media component's validation gap is then abused to access cross-origin resources the victim's browser has loaded. The Windows-specific scope indicates a platform-dependent code path, likely in Windows-specific media API handling rather than cross-platform Chromium code.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics align with vendor vector as delivery, impact scope, and user interaction are accurately characterized.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB