EUVD-2026-50672
GHSA-4567-qcr7-fjv3
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted domain (AV:N), no attacker privileges needed (PR:N), user must actively navigate (UI:R); policy bypass constitutes complete integrity compromise (I:H) with no confidentiality or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted domain name. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.
Technical ContextAI
The vulnerability resides in Google Chrome's Enterprise policy enforcement layer, which allows IT administrators to define navigation restriction policies - blocking or allowlisting specific domains for managed browser deployments. The root cause is CWE-693 (Protection Mechanism Failure), where the policy matching logic fails to correctly evaluate a specially crafted domain name, permitting navigation to destinations that should be blocked. Likely mechanisms include domain normalization issues such as IDN homograph representations, Unicode variants, trailing-dot notation, or encoding inconsistencies that cause the policy engine to evaluate the crafted domain as non-matching. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome variants, but the Enterprise qualifier in the description constrains real impact to managed deployments. The fix is present in Chrome 151.0.7922.72 per the stable channel advisory. The Chromium bug tracker entry at https://issues.chromium.org/issues/513612928 may contain additional technical specifics not included in the provided data.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, as documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators should deploy the update via Google Admin Console, Group Policy Objects (GPO), or their MDM solution to ensure managed fleet coverage. As a compensating control during the patch window, supplement Chrome Enterprise navigation policies with independent network-layer enforcement such as DNS filtering (e.g., Cisco Umbrella, Cloudflare Gateway) or proxy-based URL categorization - this removes reliance on the browser's policy engine for domain blocking and is not subject to this bypass. Note that DNS filtering may be circumvented by DoH-enabled clients, so ensure DNS-over-HTTPS is disabled or redirected in enterprise Chrome policy as an additional measure. No vendor workaround short of upgrading has been identified in the provided data.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today