EUVD-2026-50764
GHSA-fjfr-63v9-742p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page with GuestView trigger
-
DeliveryVictim navigates to page in unpatched Chrome
-
ExploitGuestView cross-origin policy enforcement bypassed
-
ExecutionMalicious script reads cross-origin data
-
ImpactExfiltrated data transmitted to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires the victim to actively visit an attacker-controlled or compromised webpage using Google Chrome prior to version 151.0.7922.72 on a desktop platform (confirmed by UI:R in the CVSS vector). The vulnerability is specific to the GuestView subsystem, so the crafted page must trigger GuestView code paths - typically through embedded <webview> or similar guest content mechanisms used in Chrome Apps or packaged extensions. No attacker authentication is required (PR:N per CVSS vector). Exploitation is not automatable per SSVC, meaning mass drive-by targeting is constrained. The impact is limited to partial cross-origin information disclosure (C:L); no integrity or availability impact is possible. Exploitation is further limited to contexts where GuestView is active - standard browser tab browsing without <webview> usage does not expose this code path. |
| Impact | CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable, low-complexity attack requiring no attacker privileges but mandating user interaction; impact is confined to partial confidentiality loss with no integrity or availability effect. EPSS of 0.21% at the 11th percentile and SSVC signals of exploitation=none, automatable=no, and technical impact=partial together confirm very low real-world exploitation urgency. Absence from the CISA KEV catalog reinforces this. Despite Chrome's ubiquitous deployment footprint, the constrained impact scope (information disclosure only, user-interaction gate, GuestView-specific code path) positions this as genuine but low-urgency - real cross-origin exposure risk in niche application contexts, not a broad unauthenticated RCE. No conflicting signals exist in the available data; all sources are consistent with a medium-severity, low-exploitation-probability vulnerability. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that triggers Chrome's GuestView code path - for example, via an embedded <webview> element - and exploits the insufficient policy enforcement to read data from a cross-origin context loaded within the page. When a user running an unpatched Chrome version visits this page, the attacker's script can exfiltrate cross-origin content such as authentication tokens or page fragments to an attacker-controlled server. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leak in Google Chrome's GuestView component (all desktop versions prior to 151.0.7922.72) enables remote attackers to read cross-origin content by luring a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-346, Origin Validation Error) within the GuestView subsystem, which handles embedded guest content such as <webview> elements in Chrome Apps and extensions. No public exploit code has been identified and CISA has not added this to the KEV catalog; an EPSS of 0.21% at the 11th percentile confirms low exploitation probability at time of analysis.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates on consumer systems; enterprise administrators should verify patch deployment via chrome://settings/help or fleet management tooling. If immediate patching is not feasible, restricting or disabling Chrome extensions and apps that embed <webview> GuestView contexts can reduce the attack surface, though this will break extension functionality that relies on guest content. Blocking navigation to untrusted or unknown web origins at the network perimeter provides a further compensating control, though it does not address the underlying flaw. No formal vendor workaround beyond patching is documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GuestView is a Chrome subsystem responsible for rendering embedded guest content inside <webview> tags, used primarily in Chrome Apps, packaged extensions, and Electron-style desktop applications. CWE-346 (Origin Validation Error) indicates the browser fails to enforce same-origin or cross-origin isolation policies within this subsystem, allowing a malicious guest frame or host page to read data from a different origin than intended. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to the 151.0.7922.72 stable release. The Chromium issue tracker entry at https://issues.chromium.org/issues/517427352 may contain additional technical detail but is not publicly accessible.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page, no privileges needed, mandatory user interaction, scope unchanged, impact limited to partial cross-origin data disclosure only.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB