EUVD-2026-50712
GHSA-m4vj-4237-7qmx
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; S:C captures cross-origin data access violating a distinct security domain; no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.
Technical ContextAI
The GPU process in Chromium's multi-process architecture handles compositing and rendering output independently from the renderer process, which executes JavaScript and processes HTML. The affected component (GPU) fails to properly enforce origin boundaries per CWE-346 (Origin Validation Error), allowing a compromised renderer process to access cross-origin GPU resources - such as textures or framebuffer data - that belong to a different security origin. This violates the browser's Same-Origin Policy at the GPU layer, a boundary that normally prevents content from one origin from reading data rendered by another. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop installations prior to 151.0.7922.72 as confirmed by EUVD-2026-50712.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism delivers this release to most users without manual action; enterprise administrators should verify deployment via Chrome Browser Cloud Management or Group Policy version reporting. Since exploitation chains through a renderer process compromise, organizations with delayed patch cycles should verify that Chrome's Site Isolation and GPU sandbox features are enabled and not overridden by enterprise policy - disabling these increases exposure to the prerequisite renderer escape stage. No direct workaround for the GPU origin validation flaw itself exists absent the version upgrade.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today