EUVD-2026-50923
GHSA-7rjx-vf6h-pvwv
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted HTML page (AV:N); AC:H reflects mandatory renderer pre-compromise; C:L for limited cross-origin data disclosure; no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.
Technical ContextAI
The vulnerability resides in Chrome's Passwords component and is classified as CWE-346 (Origin Validation Error), indicating the implementation does not properly enforce same-origin boundaries when handling password-related data within a compromised renderer context. Chrome's architecture isolates web content in sandboxed renderer processes, but this flaw allows a renderer that has already been subverted to access cross-origin data through the Passwords subsystem via a specially crafted HTML page. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions prior to 151.0.7922.72 across platforms. The Chromium bug tracker entry (https://issues.chromium.org/issues/521476960) is referenced but not fully disclosed, suggesting the technical specifics of the origin validation bypass remain restricted pending broader patch adoption.
RemediationAI
The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later, as confirmed by the Google stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this for most managed and consumer installations without manual intervention; enterprise administrators should verify fleet-wide patch status using their MDM or endpoint management tooling. No documented workarounds exist for the specific Passwords component flaw. Because exploitation requires a prior renderer process compromise, organizations that enforce Chrome's built-in sandbox hardening (e.g., site isolation, strict process-per-site policies) and keep Chrome updated to address renderer vulnerabilities reduce their aggregate exposure to chained attacks that would leverage this CVE as a secondary step. Restricting access to highly sensitive web applications from unpatched Chrome instances is a low-friction compensating control but does not address the root flaw.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today