EUVD-2026-50608
GHSA-x52f-23v9-fg5g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryVictim navigates to attacker-controlled URL
-
ExploitChrome favicon subsystem initiates cross-origin favicon fetch
-
ExecutionSide-channel exposes cross-origin resource state
-
ImpactAttacker script reads leaked data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control bypass
|
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72 on a desktop platform and must actively navigate to an attacker-controlled web page - passive drive-by exploitation without any page load is insufficient (UI:R). The CVSS PR:N confirms no authentication or account on any system is required from the attacker's side. No special Chrome configuration is required; default installations on all supported desktop platforms are affected per the CPE. Exploitation is bounded by scope: only limited cross-origin data can be inferred (C:L), and there is no integrity or availability impact. The mandatory user interaction step (victim visiting the crafted page) is the primary limiting factor for exploitation at scale. |
| Impact | The NVD CVSS score of 4.3 (Medium) is internally consistent: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), but user interaction is mandatory (UI:R) and impact is limited to partial confidentiality loss (C:L/I:N/A:N). EPSS at 0.22% (12th percentile) strongly corroborates low exploitation interest - this flaw has not attracted meaningful attacker tooling. There is no CISA KEV listing and no known public exploit code. SSVC signals collectively suggest a 'track' posture for most organizations: the vulnerability is not automatable in a meaningful sense (social engineering required to lure a victim), and the data exposed is limited in scope. For high-security environments with strict cross-origin isolation requirements - such as those handling sensitive authenticated sessions - the update warrants prompt deployment. The CVSS and EPSS signals are consistent with each other; no contradictions in the data require flagging. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page designed to trigger Chrome's favicon loading mechanism in a manner that reveals whether specific cross-origin resources exist or have been previously loaded in the victim's browser session. When a victim visits the page using an unpatched Chrome version, the browser's favicon subsystem leaks limited cross-origin state back to the attacker's page through a side-channel. No public exploit code exists at time of analysis, making mass targeting unlikely in the near term. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch. The stable channel advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism typically delivers this silently; IT administrators managing enterprise fleets should verify version compliance via endpoint management tooling and push the update where auto-update is restricted. No vendor-documented workaround exists for this specific flaw. As a compensating control for environments unable to patch immediately, restricting end-user access to untrusted or unsanctioned external websites via a corporate web proxy reduces the attack surface - this limits exposure but does not eliminate the underlying vulnerability. No significant side effects from the update itself have been noted in the vendor advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's favicon subsystem - the component responsible for fetching, caching, and displaying the small site icons shown in browser tabs and bookmarks. CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause class: the favicon loading or caching mechanism inadvertently exposes a side-channel that reveals cross-origin resource state, violating the browser's Same-Origin Policy isolation guarantees without requiring direct DOM access. This is consistent with known favicon-cache timing attacks, where a crafted page can probe whether another origin's resources have been loaded by observing favicon fetch behavior. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop releases before 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page, no privileges needed, victim visit required; impact limited to partial cross-origin data disclosure with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB