EUVD-2026-50693
GHSA-jxxr-x7vg-r26v
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page (AV:N, AC:L), victim must visit it (UI:R, PR:N); SOP bypass yields cross-origin write capability (I:H) but no data exfiltration (C:N) or availability loss (A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's ControlledFrame component prior to version 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to an unsuspecting user. The root cause is insufficient policy enforcement (CWE-346) within the ControlledFrame API, allowing an attacker to subvert origin boundaries and achieve high-integrity cross-origin impact. No active exploitation is confirmed - CISA KEV is not triggered, SSVC reports exploitation as none, and EPSS sits at a low 0.22% (13th percentile) - indicating this is a meaningful but currently theoretical browser integrity risk.
Technical ContextAI
ControlledFrame is a Chrome-specific embedding API used in Isolated Web Apps and Chrome packaged applications, providing webview-like functionality with policy enforcement around cross-origin boundaries. The vulnerability maps to CWE-346 (Origin Validation Error), a class of flaws where a component fails to properly validate the origin of a request or resource before applying a security policy, allowing the origin check to be circumvented. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects that the flaw is reachable via the network through a crafted page delivered in the browser, requires no privileges, but does require victim interaction. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome variants across platforms prior to the fixed release.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is the vendor-confirmed patched release documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this fix to most users automatically; enterprise administrators managing Chrome via policy should verify deployment through Chrome Browser Cloud Management or Group Policy. If immediate patching is not feasible, restricting access to untrusted or unknown websites via enterprise web filtering reduces exposure since the attack requires a user to visit a specifically crafted page (UI:R). Disabling or restricting Isolated Web Apps and ControlledFrame-dependent Chrome applications via enterprise policy can serve as a targeted compensating control for environments where those features are not operationally required, though this trade-off must be weighed against application functionality.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today