EUVD-2026-28081Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered via crafted page (AV:N), but high complexity due to mandatory prior renderer compromise (AC:H); no auth required on target system (PR:N); low C/I only, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient data validation in DataTransfer in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Arbitrary read/write in Google Chrome's DataTransfer component prior to version 148.0.7778.96 is exploitable by a remote attacker who has already compromised the renderer process, using a specially crafted HTML page to bypass input validation. This is a chained post-exploitation primitive rather than an initial-access vector - the renderer must already be under attacker control before this flaw becomes useful. SSVC rates exploitation as none and technical impact as partial; EPSS at 0.03% (9th percentile) and the absence of any CISA KEV listing indicate no observed active exploitation at time of analysis.
Technical ContextAI
The vulnerability exists in Chrome's DataTransfer API implementation, the web platform interface used to transfer data during drag-and-drop and clipboard operations. CWE-20 (Improper Input Validation) identifies the root cause: Chrome's DataTransfer handling fails to adequately validate attacker-supplied data before acting on it, enabling an adversary with renderer-level code execution to craft inputs that trigger out-of-bounds or otherwise unauthorized memory read/write operations within the browser process. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop versions prior to 148.0.7778.96. Tags indicating Red Hat and SUSE involvement suggest downstream Chromium packages distributed by major Linux vendors are similarly affected until updated.
RemediationAI
Update Google Chrome to version 148.0.7778.96 or later, as detailed in the vendor's stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update will deliver this release on most desktop installations; confirm the applied version via chrome://settings/help and restart the browser to activate the update. On Red Hat Enterprise Linux and SUSE systems running system-managed Chromium packages, apply the updated package once the respective vendor publishes it through their standard update channels. No documented workaround exists that preserves full browser functionality; restricting access to untrusted or unknown websites reduces exposure to the crafted HTML page required for exploitation, but this has significant usability trade-offs. Since the flaw is a chaining primitive requiring prior renderer compromise, patching the wider renderer vulnerability surface is the highest-leverage complementary control.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today