EUVD-2026-50658
GHSA-gm7f-x5cx-p924
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-delivered attack requiring active user interaction (UI:R); impact is strictly limited cross-origin data leakage (C:L); no integrity, availability, or scope-change impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
6DescriptionCVE.org
Insufficient validation of untrusted input in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.
Technical ContextAI
Isolated Web Apps (IWAs) are a Chrome-specific security architecture designed to provide stronger isolation guarantees than standard web applications by running them in a dedicated browsing context with stricter Content Security Policy enforcement and controlled network access. The root cause is CWE-20 (Improper Input Validation): Chrome's IWA subsystem fails to sufficiently validate untrusted network input, allowing the cross-origin isolation boundary to be circumvented. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions across platforms prior to the 151.0.7922.72 stable release. IWAs are distinct from standard browser tabs and are primarily used in enterprise and developer contexts, which narrows the effective attack surface relative to general Chrome vulnerabilities.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later using the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise deployment tooling such as Google Admin Console or third-party patch management platforms. The stable channel advisory is at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is constrained in enterprise environments, restricting use of Isolated Web Apps via Chrome enterprise policy (where operationally feasible) reduces the attack surface without affecting standard browsing functionality; however, this may break IWA-dependent internal applications. Enforcing user interaction hygiene - discouraging users from engaging with unexpected network prompts or unfamiliar IWA content - provides a behavioral mitigation with negligible operational cost. No patch-independent technical workaround fully eliminates the vulnerability.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today