EUVD-2026-50606
GHSA-cmf5-j3m2-rggm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryDistributes link via phishing or malvertising
-
ExploitVictim clicks link in vulnerable Chrome
-
ExecutionCrafted page triggers improper network origin validation
-
PersistCross-origin response data leaked to attacker
-
ImpactAttacker reads partial sensitive data from victim's authenticated session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires active user interaction: the victim must navigate to or be redirected to an attacker-controlled HTML page in a vulnerable Chrome instance (UI:R per CVSS). The attacker requires no privileges on the victim's system (PR:N) and no authentication to the targeted cross-origin resource - however, the value of exploitation depends on the victim already being authenticated to a third-party origin that holds sensitive data. The attack is constrained to Chrome versions below 151.0.7922.72 and produces only limited confidentiality impact (C:L) with no ability to modify data or cause denial of service. Non-default conditions that increase risk include victims who maintain persistent authenticated sessions in sensitive web applications (banking, internal tooling, healthcare portals) while browsing untrusted content. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) reflects a real but constrained risk profile: AV:N indicates network reachability but UI:R limits exploitation to scenarios where the victim actively visits a malicious page, ruling out fully passive or automated mass exploitation. The scope is unscoped (S:U) with only low confidentiality impact (C:L) and no integrity or availability consequence, meaning attackers gain partial data reads rather than full system compromise. EPSS at 0.18% (8th percentile) corroborates a low current exploitation probability, and the absence of a CISA KEV listing or reported POC further reduces near-term urgency. However, Chrome's ubiquitous deployment means the absolute number of potentially exposed endpoints is enormous. The primary realistic risk is targeted data exfiltration from authenticated web applications - an attacker who can lure a victim to a crafted page may read sensitive cross-origin data (e.g., from an internal app the victim is logged into). This is a prioritized-but-not-emergency patch scenario for most organizations. |
| Exploit ScenarioDerived | An attacker registers a domain and hosts a crafted HTML page that exploits Chrome's improper origin validation to silently issue network requests and read responses from a cross-origin target (e.g., an internal corporate web application the victim is authenticated to). The attacker distributes the link via phishing email or malicious advertisement; when the victim opens it in a vulnerable Chrome version, the page exfiltrates partial data - such as CSRF tokens, session identifiers, or page content - back to the attacker-controlled server without triggering visible browser warnings. No public proof-of-concept code has been identified at the time of this analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, which is confirmed as patched per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deploy this for most users; enterprise administrators should verify managed deployments are updated via Google Admin Console or endpoint management tooling. As a compensating control where immediate patching is not feasible, organizations can enforce web filtering or proxy policies to block navigation to untrusted or unknown external URLs, reducing the likelihood of users reaching a crafted HTML page - note this does not eliminate risk for socially engineered links within allowed domains. There are no known configuration-level workarounds to disable the vulnerable network behavior without patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-346 (Origin Validation Error), a class of flaw where software fails to properly verify that a network resource is originating from a trusted origin before granting access. In Chrome's network stack, the Same-Origin Policy (SOP) is a critical security boundary that prevents scripts on one origin from reading data from another. An 'inappropriate implementation' in Chrome's network component (as described by the reporter) allowed this boundary to be circumvented, enabling cross-origin data exfiltration. The affected product is confirmed via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome instances on all platforms prior to 151.0.7922.72. The chromium issue tracker entry (issues.chromium.org/issues/520186620) references the upstream fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring active user visit; only limited cross-origin confidentiality leak with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB