EUVD-2026-50670
GHSA-pwhf-pj3h-m735
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC elevated to H because exploitation requires prior renderer compromise, a specialized precondition not reflected in the vendor-provided AC:L rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.
Technical ContextAI
This vulnerability (CWE-20: Improper Input Validation) resides in the Navigation subsystem of Google Chrome, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. Chrome's multi-process architecture isolates web content inside a sandboxed renderer process, with navigation restrictions serving as a security boundary governing how renderer-initiated navigations are validated before being acted upon by the browser process. Insufficient validation of untrusted input originating from within a compromised renderer means that crafted navigation requests can bypass these controls, allowing unauthorized cross-origin or cross-context navigation actions that the security model is intended to prohibit. The flaw is a secondary weakness exploitable only after an initial renderer compromise, consistent with the SSVC assessment of Automatable: no.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later via the vendor-released stable channel update documented at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this fix to most desktop users without manual intervention; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or group policy. Because exploitation requires prior renderer compromise, organizations should treat this as part of broader Chrome hardening: enabling Chrome's Site Isolation (--site-per-process) and Strict Site Isolation enterprise policies reduces renderer attack surface as a compensating control. Disabling JavaScript for untrusted sites via enterprise policy would reduce renderer exploitation risk but carries significant usability trade-offs and is impractical as a general control. No workaround eliminates this specific Navigation validation flaw without patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today