EUVD-2026-28147Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered MHTML exploit requires high-complexity specific UI gestures (AC:H, UI:R); only limited cross-origin read achieved with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's MHTML implementation (versions prior to 148.0.7778.96) allows a remote attacker to read limited data across origin boundaries by luring a user into performing specific UI interactions on a crafted MHTML page. Rated Low severity by the Chromium security team with a CVSS score of 3.1, the vulnerability carries an EPSS of 0.01% (1st percentile) and is not listed in CISA KEV, with SSVC exploitation status confirmed as none. No public exploit code has been identified at time of analysis.
Technical ContextAI
MHTML (MIME HTML, RFC 2557) is a web archive format that bundles HTML and its resources into a single file, supported natively by Chromium-based browsers. The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), a class of vulnerabilities involving insufficient separation between UI rendering contexts - often associated with clickjacking, UI redressing, or frame-overlay attacks. In this case, an inappropriate implementation in Chrome's MHTML parser or renderer fails to properly enforce cross-origin isolation, allowing data from a protected origin to be exposed to the attacker-controlled MHTML context when the user performs specific gestures. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to the fix. The tagging of this issue as 'XSS' in intelligence sources is likely an approximate label - the actual mechanism is closer to a UI layer restriction bypass rather than classic reflected or stored XSS (CWE-79).
RemediationAI
The primary fix is to upgrade Google Chrome to version 148.0.7778.96 or later, which is confirmed as the patched release per the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this update to most users without manual intervention; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or Group Policy. No specific workarounds have been published by Google for this vulnerability. As a compensating control prior to patching, organizations may consider blocking or stripping MHTML (.mht/.mhtml) file downloads at the network or email gateway layer, though this may disrupt legitimate use cases such as archived web content sharing. Disabling MHTML handling at the OS file association level is technically possible but impractical in most enterprise contexts.
Share
External POC / Exploit Code
Leaving vuln.today