EUVD-2026-50634
GHSA-4xcj-35rw-3hvj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered, no auth required; victim must visit crafted page (UI:R); impact limited to cross-origin data disclosure with no integrity or availability consequence (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.
Technical ContextAI
The vulnerability originates in Chrome's Paint subsystem, which handles low-level rendering operations such as compositing and pixel-level drawing across browser contexts. CWE-346 (Origin Validation Error) indicates that the Paint implementation does not correctly enforce Same-Origin Policy boundaries when processing or rendering cross-origin resources, potentially exposing rendered pixel data or other origin-bound artifacts to a malicious page. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all Chrome versions across Windows, macOS, and Linux prior to the 151.0.7922.72 stable release. The Chromium issue tracker reference (issues.chromium.org/issues/523698038) provides the upstream engineering record. The flaw is classified by the Chrome security team as Medium severity, consistent with its constrained, read-only cross-origin impact and user-interaction prerequisite.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which resolves this vulnerability per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates on consumer endpoints; enterprise administrators should verify fleet update compliance via group policy or endpoint management tooling to confirm no instances are pinned to older versions. As a temporary compensating control, content filtering policies that block navigation to untrusted or externally hosted pages reduce exposure at the cost of browsing flexibility - this is suitable only as a short-term measure until the patch is deployed. No adverse side effects from the patch itself are indicated by vendor documentation.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today