EUVD-2026-23068
GHSA-qcvg-hwr7-r9v7
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leak in Google Chrome prior to 147.0.7727.101 through insufficient CORS enforcement when the renderer process is already compromised. An attacker who has first achieved code execution inside the renderer can bypass cross-origin restrictions to expose sensitive data from other origins via a crafted HTML page. No active exploitation or public proof-of-concept has been identified, and the EPSS probability is extremely low at 0.01%.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today