EUVD-2026-34712
GHSA-x55h-6hhf-jw8h
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google) · only source for this CVE.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Insufficient policy enforcement in Google Chrome's Password Manager (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to bypass discretionary access control via a crafted HTML page, resulting in limited confidentiality exposure. This is a chained vulnerability: exploitation is contingent on a prior renderer process compromise, which substantially elevates attack complexity and limits realistic blast radius. No public exploit code exists and this CVE is not listed in the CISA KEV catalog. Google has rated this Low severity and released a fix in Chrome 149.0.7827.53.
Technical ContextAI
The vulnerability resides in the Password Manager component of Google Chromium, the open-source browser engine underpinning Google Chrome. CWE-20 (Improper Input Validation) indicates that the Password Manager's policy enforcement logic fails to adequately validate state or inputs when the renderer process - the sandboxed content process responsible for parsing and rendering HTML - has been compromised. Chrome's security model relies on process isolation and a multi-layer permission/policy framework; a compromised renderer should be constrained from accessing sensitive browser state like stored credentials. This flaw breaks that isolation boundary specifically within the Password Manager subsystem. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires high complexity, no attacker privileges, user interaction, and produces only limited confidentiality impact with no scope change, meaning the attacker cannot pivot further beyond the user's browser session context.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released fix as confirmed by the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically auto-updates on desktop platforms; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or Group Policy. Because exploitation requires a prior renderer process compromise, organizations can reduce the overall attack surface by ensuring Chrome's sandbox is not disabled (avoid --no-sandbox flags in managed deployments), keeping all Chromium-based browser components up to date to reduce the likelihood of a renderer exploit chain being viable, and enforcing Chrome enterprise policies to restrict access to Password Manager features on high-sensitivity endpoints if credential exposure is a concern. No additional workarounds are required for most deployments given the low severity and chained exploitation requirement.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today