EUVD-2026-34590
GHSA-m4xv-prr9-c93r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) enables a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. The flaw is classified under CWE-352 (Cross-Site Request Forgery), indicating the Extensions implementation incorrectly handles cross-origin request validation in a way that bypasses same-origin isolation boundaries. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (11th percentile) signals low current exploitation probability despite the High confidentiality impact rating.
Technical ContextAI
The vulnerability resides in Google Chrome's Extensions subsystem, where an inappropriate implementation introduces a CSRF-class flaw (CWE-352) that undermines cross-origin data isolation enforced by the browser's same-origin policy. Browser extensions frequently operate with elevated permissions and can interact with page content across multiple origins; when the extension subsystem improperly validates the origin of requests or fails to enforce adequate cross-origin checks, a crafted HTML page can exploit this to leak data from otherwise isolated contexts. The affected product is Google Chrome stable channel prior to version 149.0.7827.53 across all desktop platforms. The CVSS confidentiality impact of High (C:H) combined with zero integrity and availability impact (I:N/A:N) is consistent with a read-only data exfiltration primitive, not arbitrary code execution. The Chromium issue tracker reference (issues.chromium.org/issues/501541962) provides upstream detail, though it may be access-restricted pending broader patch adoption.
RemediationAI
The primary fix is to upgrade Google Chrome to version 149.0.7827.53 or later, which is the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default; enterprise administrators should verify fleet-wide deployment and trigger forced updates for managed devices where auto-update is delayed or disabled via policy. As a compensating control where immediate patching is not feasible, restricting third-party Chrome Extension installation using the ExtensionInstallBlocklist or ExtensionInstallAllowlist enterprise policies reduces the extensions attack surface implicated in this flaw, though this does not remediate the underlying vulnerability and may disrupt user workflows dependent on extensions. Additionally, enforcing web filtering to block known malicious or unvetted domains reduces the likelihood of victims reaching attacker-hosted exploit pages that rely on the UI:R prerequisite.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today