EUVD-2026-34429
GHSA-j7v7-xwp3-68qr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Same-origin policy bypass in Google Chrome's DevTools component (all versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to bypass SOP protections via a crafted HTML page, resulting in a high-integrity impact with no confidentiality or availability loss. The attack requires user interaction (victim must visit a malicious page) and a prior renderer process compromise as a chained prerequisite, materially constraining real-world exploitability beyond the raw CVSS score implies. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; EPSS probability stands at 0.02% (6th percentile), consistent with a low-probability exploitation scenario.
Technical ContextAI
The vulnerability resides in the DevTools subsystem of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and is rooted in CWE-20 (Improper Input Validation). DevTools processes untrusted input passed from a potentially compromised renderer context without sufficient validation, enabling crafted HTML content to manipulate DevTools in a way that subverts the browser's same-origin policy (SOP) enforcement. SOP is a critical browser security boundary that prevents scripts from one origin from accessing resources on a different origin; bypassing it allows cross-origin content manipulation. The attack path is a browser sandbox escape chain: a separate vulnerability must first establish renderer process compromise before this flaw can be leveraged. Reported by chrome-cve-admin@google.com and tracked as EUVD-2026-34429.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, which is confirmed as the vendor-patched release per the Google Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should deliver this patch automatically; administrators managing enterprise deployments should verify rollout via policy controls. As a compensating control where immediate patching is not possible, restricting or disabling DevTools access for end users (via enterprise policy DevToolsAvailability=Disabled) would eliminate the vulnerable attack surface, though this trade-off removes legitimate developer tooling. Additionally, because exploitation requires a prior renderer compromise, ensuring Chrome's site isolation and sandbox features are enabled (default in modern Chrome) raises the bar for the full attack chain.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today