EUVD-2026-50698
GHSA-pp42-fqp9-76jc
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer pre-compromise prerequisite; S:C captures the site isolation boundary crossing enabling cross-origin data access and modification.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Site isolation bypass in Google Chrome's Extensions subsystem before version 151.0.7922.72 allows an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page, enabling access to or modification of data from other loaded origins. This is a chained exploit primitive - it depends on prior renderer compromise - making it a significant escalation step rather than a standalone entry point. No public exploit code has been identified and CISA SSVC rates exploitation status as none, consistent with the low EPSS score of 0.22% (13th percentile).
Technical ContextAI
The vulnerability stems from an inappropriate implementation within Chrome's Extensions subsystem, classified under CWE-346 (Origin Validation Error), where the browser fails to correctly validate the origin context of certain extension-mediated interactions. Chrome's site isolation architecture is a core security boundary: each site runs in its own renderer process to prevent cross-origin data leakage. The flaw allows an attacker already inside a compromised renderer to abuse the Extensions code path to escape this process-level boundary. All Chrome desktop versions captured by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to 151.0.7922.72 are affected across all supported desktop platforms. The Chromium security team rated this Medium severity internally.
RemediationAI
The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates in consumer environments, but enterprise administrators should verify that managed endpoints have received the update via fleet management tooling. As a compensating control, organizations can enforce extension allowlisting via Chrome Enterprise policy, restricting the Extensions subsystem to a curated set of policy-managed extensions; this reduces the attack surface of the vulnerable code path without eliminating the flaw. Restricting or disabling untrusted extensions does carry an operational trade-off for end users who rely on browser extensions for productivity. No workaround fully mitigates the vulnerability without patching.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today