EUVD-2026-34603
GHSA-g3jm-h647-x2wg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's Paint component prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to violate cross-origin integrity protections by inducing a user to visit a crafted HTML page. The flaw stems from insufficient policy enforcement in the Paint subsystem (CWE-639), enabling an attacker to write or manipulate content across origin boundaries, resulting in high integrity impact with no confidentiality or availability loss per the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) indicates very low current exploitation probability.
Technical ContextAI
The affected component is Chrome's Paint subsystem, part of the Blink rendering engine responsible for compositing and drawing web content. CWE-639 (Authorization Bypass Through User-Controlled Key) indicates that an attacker-controlled value - likely a resource identifier or origin token used during paint operations - can be manipulated to circumvent same-origin policy (SOP) enforcement. SOP is the foundational browser security boundary separating content from distinct origins; a bypass allows cross-origin DOM writes or resource access without explicit CORS permission. The affected version range covers all Chrome releases prior to 149.0.7827.53 on desktop platforms, per the ENISA EUVD entry EUVD-2026-34603 and the affected CPE range 'Chrome 149.0.7827.53 < 149.0.7827.53'.
RemediationAI
Vendor-released patch: Chrome 149.0.7827.53. Users and administrators should update Google Chrome to version 149.0.7827.53 or later via Chrome's built-in update mechanism (chrome://settings/help) or through enterprise deployment tooling such as Google Update or OS-level package managers. The fix is documented in the stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For environments where immediate patching is not feasible, administrators can reduce exposure by enforcing browser management policies that restrict navigation to untrusted external sites, deploying URL filtering to block known malicious domains, and enabling Chrome's Enhanced Safe Browsing mode - though these are compensating controls, not remediation, and carry the trade-off of reduced browsing freedom or reliance on Google's threat intelligence feed. No workaround that fully mitigates the Paint SOP bypass without patching has been identified from available data.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today