EUVD-2026-50603
GHSA-8487-52vc-ggw6
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted page requires user visit (UI:R); no auth needed; SOP bypass yields high integrity impact with no confidentiality or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running Google Chrome prior to version 151.0.7922.72 with the WebMCP component active (the feature present in Chrome 151.x desktop builds). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity attack with no privilege requirement but mandatory user interaction; the scope is unchanged and confidentiality is unaffected while integrity is rated High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page and lures a victim running an unpatched Chrome browser to visit it, for example via phishing email or malicious advertisement. Upon page load, the crafted content exploits the WebMCP origin validation gap to perform cross-origin write operations that would ordinarily be blocked by same-origin policy, enabling the attacker to tamper with the integrity of cross-origin content accessible through the browser session. … |
| Remediation | Upgrade Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-patched release via the stable channel update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today