EUVD-2026-34616
GHSA-m863-36pg-4j7w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows remote unauthenticated attackers to read sensitive cross-origin information by directing a victim to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no privilege requirement, limited only by the need for user interaction. EPSS is 0.03% (11th percentile) and no public exploit has been identified at time of analysis; however, Google has issued a confirmed patch in the stable channel release, and the CWE-352/CSRF tag alongside the data-leakage description suggests a novel or hybrid attack class that security teams should monitor for further clarification.
Technical ContextAI
The vulnerability resides in Google Chrome's CSS rendering engine, where an inappropriate implementation allows cross-origin data to be inferred or extracted when processing attacker-controlled stylesheets. CWE-352 (Cross-Site Request Forgery) is assigned and tagged, which is notable tension against the described behavior of cross-origin data leakage - suggesting the CSS flaw may enable a CSRF-oracle-style attack, where CSS side-channel techniques (such as :visited selector probing, scroll-driven animation timing, or CSS injection into cross-origin iframes) are used to infer response state or content across origins without direct script access. All Google Chrome desktop releases prior to 149.0.7827.53 on Windows, macOS, and Linux are affected per the EUVD-2026-34616 entry. No CPE strings were provided in the source data. Chromium-derived browsers sharing the same CSS engine may also be affected but require independent vendor confirmation.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later, as confirmed by the vendor's stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on most platforms; end-users can manually trigger the update via chrome://settings/help. Enterprise administrators should push the update through group policy or endpoint management tooling. Prior to patching, a compensating control is to restrict user access to untrusted or unfamiliar external web content via proxy filtering or browser isolation solutions; however, this has significant usability trade-offs and does not address legitimate adversarial pages that may appear trustworthy. No vendor-documented workarounds specific to this CSS implementation flaw were identified in the available references.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today