EUVD-2026-28025Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Permissions in Google Chrome prior to 148.0.7778.96 allowed an attacker on the local network segment to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Google Chrome prior to version 148.0.7778.96 contains insufficient validation of untrusted input in the Permissions system, allowing attackers on the local network segment to leak cross-origin data through malicious network traffic. The vulnerability requires network adjacency but no user interaction or authentication, affecting confidentiality with medium Chromium severity. Patch is available from Google.
Technical ContextAI
The vulnerability exists in Chrome's Permissions subsystem, which handles cross-origin data access policies. The root cause is classified as CWE-20 (Improper Input Validation), indicating that untrusted network traffic is not adequately validated before being processed by the permissions logic. An attacker positioned on the same local network segment can craft malicious network packets that bypass validation checks, exploiting the permissions validation mechanism to access data that should be restricted by same-origin policy. This is a network-layer attack rather than a traditional web-based exploit.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later immediately. Google has released a patch available through the Chrome update mechanism-users can check Settings > About Chrome to trigger automatic updates and verify successful patching to version 148.0.7778.96 or higher. For organizations requiring manual deployment, the patch is available via Google's official release channels documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. As a temporary compensating control in high-risk environments, disable or restrict Chrome usage on untrusted network segments until patching is complete, though this is impractical long-term. Network segmentation to isolate trusted devices from potential attackers on the same network segment provides partial mitigation but is not a substitute for patching.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today