EUVD-2026-50857
GHSA-5c44-q4c4-6x7j
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Remote crafted-page delivery requires no attacker auth (PR:N) but victim must visit it (UI:R); scope stays within Chrome (S:U); only integrity is impacted.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.
Technical ContextAI
The vulnerability resides in the DevTools component of Google Chrome, classified under CWE-693 (Protection Mechanism Failure), which describes a condition where an existing security control is either incorrectly implemented or not consistently enforced. Chrome DevTools provides developer-facing functionality including network inspection, console interaction, and navigation control interfaces deeply integrated with the Chromium rendering engine. The inappropriate implementation allows these navigation guardrails - mechanisms intended to prevent unauthorized cross-origin or restricted navigation - to be bypassed through a maliciously crafted HTML page. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop stable channel releases prior to 151.0.7922.72. Notably, Google Chromium's internal severity classification is Low, which contrasts with NVD's Medium CVSS score of 6.5, likely reflecting Chromium's conservative view that DevTools-scoped navigation bypasses have limited exploitable consequence in most threat models.
RemediationAI
The primary remediation is upgrading Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch. The stable channel update advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates in most consumer environments, but enterprise administrators should verify that update policies (e.g., via Google Admin Console or group policy) are not blocking or delaying delivery. As an interim compensating control, enterprises can deploy the DevToolsDisabled Chrome policy to restrict DevTools access entirely - this eliminates the vulnerable attack surface but carries the trade-off of blocking all developer tooling workflows for end users, which may be acceptable in non-developer environments. Restricting access to untrusted external websites via web filtering policies also reduces exposure, since exploitation requires user navigation to a crafted external page.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today