EUVD-2026-50592
GHSA-7g7q-x3jc-wh3x
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Web-delivered payload requires victim navigation (UI:R, PR:N); limited cross-origin data exposure only with no integrity or availability impact (C:L, I:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is using Google Chrome on a version prior to 151.0.7922.72 and actively navigates to an attacker-controlled or compromised web page containing the crafted HTML/CSS payload - confirmed by the CVSS UI:R metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) reflects a network-reachable attack (AV:N) with low complexity (AC:L) and no authentication requirement on the attacker side (PR:N), but mandates victim user interaction via page navigation (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts an HTML page embedding CSS that exploits Chrome's origin validation flaw to infer or extract data belonging to a cross-origin resource the victim's browser has access to - for example, inferring authenticated state or partial content from a co-visited origin. The victim is directed to the attacker's page via phishing, a malicious advertisement, or a compromised website, and the data exfiltration occurs silently during page rendering without further interaction. … |
| Remediation | The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today