EUVD-2026-50578
GHSA-h7f7-vcph-w379
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker-controlled server
-
DeliveryLure victim to page via phishing or malvertising
-
ExploitTrigger policy bypass in Chrome Passwords component
-
ExecutionRead cross-origin credential or session data
-
ImpactExfiltrate leaked data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | The victim must actively visit a crafted HTML page, as confirmed by the CVSS UI:R metric - passive exploitation without user navigation is not possible. Chrome's built-in Passwords component must be in use; users who rely solely on a third-party password manager extension and have Chrome's native password manager disabled are not exposed through this specific attack path. The attacker requires no authentication or privileges (PR:N, AV:N), meaning any internet-reachable attacker can host the malicious page. Exploitation is limited to Chrome desktop versions prior to 151.0.7922.72 on all supported platforms. The impact is bounded to partial confidentiality loss (C:L) - full credential exfiltration or remote code execution is not indicated by the available data. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible vulnerability with low complexity and no required privileges for the attacker, but user interaction (UI:R) is mandatory and the confidentiality impact is limited (C:L), with no integrity or availability impact. The S:U (unchanged scope) metric indicates the vulnerability is contained within the browser's security boundary and does not enable lateral movement to the underlying OS. EPSS at 0.21% in the 11th percentile confirms that exploitation probability in the near term is very low, consistent with the absence of KEV listing and no identified public POC. The practical risk is therefore low-to-moderate for most environments: the vulnerability requires active user navigation to an attacker-controlled page and yields only partial credential or cross-origin data exposure, not full credential exfiltration or code execution. The primary concern is targeted phishing campaigns or watering-hole attacks against high-value users. This is a real but low-urgency patching priority - prioritize for users in sensitive roles where partial credential data leakage could be consequential. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that exploits the insufficient origin validation in Chrome's Passwords component - for example, by triggering an autofill interaction or credential lookup that leaks data across an origin boundary into the attacker-controlled page context. The victim visits this page (via phishing link, malicious advertisement, or compromised site) while running an unpatched version of Chrome with the password manager enabled. The attacker's page then reads the cross-origin credential or session data exposed by the policy bypass. No public POC exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code exists, and this CVE is not listed in the CISA KEV catalog, indicating low observed real-world exploitation pressure despite the ubiquity of the affected product.
RemediationAI
The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or direct download from Google. The vendor advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprise environments using Chrome's extended stable or managed update channels, administrators should push the update through their MDM or group policy infrastructure. As a compensating control where immediate patching is not feasible, disabling Chrome's built-in password manager (via chrome://settings/passwords, set 'Offer to save passwords' to off) would remove the affected component from the attack surface, though this trades security for user convenience and may push users toward less secure credential storage. Restricting access to untrusted external websites via content filtering or browser isolation platforms would also reduce exposure, particularly for high-risk user populations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) describes failures in verifying that a request, resource, or data source originates from the expected security boundary. In this case, Google Chrome's built-in Passwords component - the browser-native credential manager that stores, autofills, and suggests passwords - fails to enforce the same-origin policy sufficiently when handling interactions triggered by HTML page content. This allows a cross-origin information leak, meaning JavaScript or HTML on one origin can potentially read data that should be isolated to a different origin, specifically as it passes through or is exposed by the Passwords subsystem. The affected surface is the desktop browser application itself (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), covering all platforms (Windows, macOS, Linux) running Chrome prior to 151.0.7922.72. The Chromium security team rated this Medium severity.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), no attacker privileges needed (PR:N), user must navigate to the page (UI:R), and impact is limited to partial cross-origin data disclosure with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB