EUVD-2026-34684
GHSA-jp3q-3vh2-xf59
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in Google Chrome's Network component (versions prior to 149.0.7827.53) enables a post-compromise attacker who already controls the renderer process to subvert cross-origin enforcement via a crafted HTML page. The CVSS integrity impact is rated High (I:H), but exploitation is gated behind a required renderer-process pre-compromise, substantially raising the real-world attack bar. No public exploit code exists and no CISA KEV listing is present; EPSS stands at 0.02% (6th percentile), consistent with Google's own Low severity rating for this issue.
Technical ContextAI
The vulnerability resides in Chrome's Network component - the subsystem responsible for HTTP/HTTPS request handling, cookie enforcement, and cross-origin policy decisions - and is classified under CWE-20 (Improper Input Validation). Chrome's multi-process sandbox architecture routes renderer-process network requests through IPC to the browser process, where same-origin policy is enforced. When the Network component fails to sufficiently validate untrusted input originating from the renderer, a compromised renderer can supply crafted inputs that cause SOP checks to be bypassed, enabling unauthorized cross-origin write operations. Affected product per ENISA EUVD-2026-34684 is Google Chrome versions in the range below 149.0.7827.53 on all supported desktop platforms.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, as detailed in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates in consumer environments; enterprise administrators using Google Update or Group Policy should verify deployment of this version promptly. As a compensating control for environments delaying the update, enforcing Chrome's Site Isolation mode (--site-per-process, the current default) limits the blast radius of any renderer-level compromise that could be used to trigger this secondary bypass. Restricting users from visiting untrusted or externally supplied URLs in browser sessions that handle sensitive cross-origin data also reduces the attack surface for the required upstream renderer exploit. Note that these controls address the prerequisite stage of the attack chain rather than the specific vulnerability itself.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today