EUVD-2026-34705
GHSA-q6p3-5hc9-mj6w
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in Google Chrome's WebAuthentication component affects all Chrome versions prior to 149.0.7827.53, exploitable only by a remote attacker who has already compromised the renderer process. Insufficient input validation in the WebAuthn subsystem allows crafted HTML pages to circumvent same-origin restrictions, resulting in limited confidentiality disclosure (C:L). Chromium's own severity classification is Low, consistent with the CVSS 3.1 score of 3.1, and no public exploit or CISA KEV listing has been identified at time of analysis. The mandatory prerequisite of renderer process compromise significantly constrains the realistic attacker population to sophisticated, multi-stage threat actors.
Technical ContextAI
The vulnerability resides in Chrome's WebAuthentication (WebAuthn) implementation, the browser subsystem handling FIDO2/passkey credential flows. CWE-20 (Improper Input Validation) identifies the root cause: attacker-controlled input from a crafted HTML page is not sufficiently sanitized or validated before being processed within the WebAuthn code path. Because Chrome's multi-process architecture isolates renderer processes from the browser process, the attacker must first breach that sandbox - a non-trivial precondition. The CVSS vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a network-reachable flaw requiring high attack complexity (the renderer compromise) and user interaction (visiting a crafted page), with impact limited to low confidentiality loss and no scope change. Affected CPE is all Chrome desktop releases prior to 149.0.7827.53 per EUVD entry EUVD-2026-34705.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this fix automatically in most managed and consumer environments; administrators should verify deployment via enterprise policy or endpoint telemetry. Because exploitation requires prior renderer compromise, organizations that have not already done so should enable Chrome's Site Isolation feature (--site-per-process, enabled by default in recent Chrome versions) and enforce renderer sandbox policies, as these controls independently reduce the likelihood that a renderer compromise can be achieved as the prerequisite step. No workaround that eliminates this specific same-origin bypass without upgrading has been identified in the available intelligence.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today