EUVD-2026-34617
GHSA-g4qr-96mv-425v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a user to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-exploitable, no-privilege-required exploitation with a single user interaction as the only barrier. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation interest despite the low attack complexity.
Technical ContextAI
The flaw resides in Google Chrome's CSS subsystem, where an inappropriate implementation permits cross-origin data to be inferred or read through a specially crafted HTML page. CSS-based cross-origin leaks typically exploit browser behaviors such as CSS selector matching against cross-origin content, @import side-channels, or rendering timing discrepancies to exfiltrate information that the Same-Origin Policy is meant to protect. The assigned CWE-352 (Cross-Site Request Forgery) is notable and potentially imprecise for a data-leak class bug; CWE-352 classically covers forged state-changing requests, while the described impact is purely confidentiality-focused (C:L/I:N). This mapping inconsistency may reflect the CSS mechanism acting as a cross-origin request vehicle, but the root cause is more accurately characterized as a Same-Origin Policy bypass or information disclosure in the CSS engine. Affected product per EUVD CPE data: Google Chrome versions below 149.0.7827.53 across all supported desktop platforms.
RemediationAI
The primary fix is to update Google Chrome to version 149.0.7827.53 or later, which was confirmed by Google's Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy and confirm the installed version is at or above 149.0.7827.53. If immediate patching is not possible, a compensating control is to restrict browser access to untrusted or externally-hosted HTML pages through web filtering or content security policies at the network perimeter - this reduces the UI:R exploitation opportunity. Note that blocking access to external URLs is operationally disruptive and not a sustainable long-term mitigation; patching remains the definitive fix. No workaround for the underlying CSS implementation flaw is available without the vendor patch.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today