EUVD-2026-50914
GHSA-whqv-v3xx-92x8
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics align with network delivery, required user interaction, and integrity-only impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation input validation bypass in Google Chrome prior to 151.0.7922.72 enables a renderer-compromised attacker to circumvent navigation restrictions via a crafted HTML page. The flaw is the second stage of a chained attack - exploitation requires a prior renderer process compromise, substantially raising the practical bar for abuse. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), consistent with its role as a post-exploitation primitive rather than an initial access vector.
Technical ContextAI
Google Chrome's renderer process handles HTML parsing, JavaScript execution, and navigation logic within a sandboxed context. CVE-2026-17988 stems from CWE-20 (Improper Input Validation) in the Navigation component, where attacker-controlled data originating from a compromised renderer is not sufficiently validated before influencing navigation decisions. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all platforms (Windows, macOS, Linux). The Navigation component bridges the renderer (untrusted) and browser process (trusted), and insufficient boundary enforcement at this interface is the root cause class. A renderer compromise is the prerequisite - typically achieved via a separate V8 or Blink memory-corruption bug - after which this flaw extends the attacker's reach by defeating navigation-level security policies.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise deployment tooling (SCCM, Intune, etc.). The stable channel update is documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because exploitation requires a prior renderer compromise, organizations should also prioritize patching against renderer-level memory-corruption bugs that could serve as the first-stage exploit in a chain. As a compensating control prior to patching, enabling Chrome's Site Isolation feature (already default in modern Chrome but worth verifying in managed deployments) limits renderer blast radius, though it does not directly address this flaw. No functional workaround removes the navigation validation gap without the upstream patch.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today