EUVD-2026-30380
GHSA-g2gq-v6g9-5365
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restrictions can be bypassed in Google Chrome for Windows versions prior to 148.0.7778.168 when attackers craft malicious HTML pages that exploit insufficient sandbox policy enforcement in iframe elements. User interaction (opening/visiting the crafted page) is required for exploitation. Google released a patched version addressing this medium-severity flaw. With EPSS exploitation probability at 0.02% (4th percentile) and no KEV listing, this represents a moderate-priority issue primarily affecting organizations running outdated Chrome versions on Windows systems.
Technical ContextAI
This vulnerability stems from insufficient policy enforcement (CWE-693) in Chrome's iframe sandbox implementation on Windows platforms. HTML iframe sandbox attributes are security mechanisms designed to restrict capabilities of embedded content, including navigation controls that prevent sandboxed frames from redirecting the top-level browsing context or navigating other frames. The flaw allows specially crafted HTML to circumvent these navigation restrictions, potentially enabling clickjacking, phishing redirection, or cross-frame attacks. The vulnerability is platform-specific to Windows builds of Chrome, suggesting OS-level interaction in the sandbox enforcement logic. The Chromium bug tracker reference (issues/40061220) indicates this was identified through Chrome's internal security review process.
RemediationAI
Update Google Chrome to version 148.0.7778.168 or later immediately through Chrome's built-in updater (Settings → About Chrome) or by downloading from google.com/chrome. Chrome typically auto-updates within 24-48 hours but manual update ensures immediate protection. Organizations should push version 148.0.7778.168+ through enterprise management tools (WSUS, SCCM, Intune, or Chrome Browser Cloud Management). For environments unable to patch immediately, implement compensating controls: deploy browser isolation technology to sandbox all web content in remote containers, enforce strict URL filtering to block known-malicious domains delivering crafted HTML, and train users to avoid clicking links in unsolicited emails or messages. Note that disabling iframe sandbox features would create broader security gaps and is not recommended. Content Security Policy (CSP) headers with frame-ancestors and frame-src directives provide defense-in-depth but do not fully mitigate this client-side parsing vulnerability. Verify deployment success by checking chrome://settings/help shows version 148.0.7778.168 or higher. Reference advisory: http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today