EUVD-2026-50846
GHSA-j795-4rhg-3gv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate Chrome vulnerability
-
DeliveryCraft malicious HTML page
-
ExploitDeliver page to victim browser
-
ExecutionTrigger password policy enforcement bypass
-
ImpactLeak cross-origin saved credential data
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires two distinct preconditions: first, the attacker must have already compromised the Chrome renderer process through a separate, independent vulnerability - this is explicitly stated in the CVE description ('remote attacker who had compromised the renderer process'). Second, the victim must interact with (visit or be redirected to) a crafted HTML page while using an unpatched Chrome version below 151.0.7922.72. User interaction is required (UI:R in the CVSS vector). The victim must also have passwords saved in Chrome's built-in Passwords manager for those credentials to be at risk of disclosure. Limiting factors: this is not exploitable by a direct, unauthenticated remote attacker against a default Chrome installation - a separate renderer-compromise primitive is mandatory as the entry point, substantially raising the attack bar. Exploitation is not automatable (SSVC) and requires high attack complexity (AC:H). No special server-side configuration is required, but the attacker must already control the renderer process on the victim's machine. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) yields a base score of 3.1 (Low), and the signal constellation fully supports this low urgency rating. AC:H correctly reflects the high complexity: exploitation first requires a separate renderer-process compromise, making this a chained, multi-stage attack rather than a standalone exploit. EPSS at 0.21% (11th percentile) independently confirms that the security community sees negligible automated exploitation probability. SSVC rates exploitation as 'none' and automatable as 'no', aligning with EPSS. The technical impact is rated 'partial' by SSVC (confidentiality only, C:L in CVSS), which is accurate - this is a data-disclosure-only issue with no integrity or availability consequence. There are no conflicting signals: all available frameworks converge on low-to-medium real-world risk. The primary risk population is users whose Chrome renderer has already been exploited by a separate vulnerability, at which point this bug enables credential data to be recovered across origins - a meaningful escalation within an existing breach, but not an initial access vector. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate renderer-process vulnerability in Chrome (e.g., a V8 or Blink memory corruption bug) then serves the victim a crafted HTML page that leverages the insufficient policy enforcement in the Passwords component. The compromised renderer issues cross-origin credential requests that bypass origin validation, causing the Passwords subsystem to disclose saved credentials belonging to a different origin back to the attacker-controlled renderer context. No public proof-of-concept exists for this specific vulnerability; the attack is a chained second-stage technique requiring an existing renderer foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
RemediationAI
The primary remediation is upgrading Google Chrome to version 151.0.7922.72 or later, which includes the vendor-released patch. Users can update via Chrome menu → Help → About Google Chrome or through enterprise management tools. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html should be referenced for release notes. Because exploitation requires a prior renderer compromise as a prerequisite, organizations that cannot immediately deploy the patch should prioritize patching any other open renderer-level Chrome vulnerabilities first, as this flaw is only reachable once the renderer sandbox is already breached. Enabling Chrome's Enhanced Safe Browsing and sandboxing hardening policies via enterprise GPO reduces the attack surface for the renderer-compromise precondition. Chromium-based browser vendors should verify and apply the upstream fix from https://issues.chromium.org/issues/522545249.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) describes a failure to correctly verify that a resource or action originates from an expected, trusted source. In Chrome's multi-process architecture, the renderer process handles web content and is deliberately sandboxed. The Passwords component is responsible for autofill and credential management; it enforces same-origin checks before providing stored credentials to page contexts. When the renderer is compromised (e.g., via a prior memory corruption exploit in Blink/V8), an attacker-controlled renderer can issue crafted requests to the Passwords subsystem that bypass its origin validation, allowing credentials belonging to one origin to be observed by another. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop builds below 151.0.7922.72. This vulnerability is a second-stage issue - it is a sandbox-escape primitive targeting a specific browser subsystem rather than a standalone entry point.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; C:L only as cross-origin data disclosure is partial; no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB