EUVD-2026-50578
GHSA-h7f7-vcph-w379
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), no attacker privileges needed (PR:N), user must navigate to the page (UI:R), and impact is limited to partial cross-origin data disclosure with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code exists, and this CVE is not listed in the CISA KEV catalog, indicating low observed real-world exploitation pressure despite the ubiquity of the affected product.
Technical ContextAI
CWE-346 (Origin Validation Error) describes failures in verifying that a request, resource, or data source originates from the expected security boundary. In this case, Google Chrome's built-in Passwords component - the browser-native credential manager that stores, autofills, and suggests passwords - fails to enforce the same-origin policy sufficiently when handling interactions triggered by HTML page content. This allows a cross-origin information leak, meaning JavaScript or HTML on one origin can potentially read data that should be isolated to a different origin, specifically as it passes through or is exposed by the Passwords subsystem. The affected surface is the desktop browser application itself (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), covering all platforms (Windows, macOS, Linux) running Chrome prior to 151.0.7922.72. The Chromium security team rated this Medium severity.
RemediationAI
The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or direct download from Google. The vendor advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprise environments using Chrome's extended stable or managed update channels, administrators should push the update through their MDM or group policy infrastructure. As a compensating control where immediate patching is not feasible, disabling Chrome's built-in password manager (via chrome://settings/passwords, set 'Offer to save passwords' to off) would remove the affected component from the attack surface, though this trades security for user convenience and may push users toward less secure credential storage. Restricting access to untrusted external websites via content filtering or browser isolation platforms would also reduce exposure, particularly for high-risk user populations.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today