EUVD-2026-34732
GHSA-46w6-529v-97xg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Passwords component (all versions prior to 149.0.7827.53) allows an unauthenticated remote attacker to read sensitive cross-origin information by serving a crafted HTML page and social-engineering the victim into performing specific UI gestures. The CVSS score of 6.5 reflects high confidentiality impact (C:H), though the attack is gated by mandatory user interaction, which materially limits real-world exploitability. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at just 0.03% (11th percentile), and the Chromium security team rated this vulnerability Low severity - all signals consistent with a narrowly exploitable information disclosure rather than a broad critical threat.
Technical ContextAI
The vulnerability resides in the Passwords subsystem of Google Chrome's browser engine (Chromium), which manages saved credentials and interacts with web page contexts during autofill and password-related UI flows. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), describing scenarios where an implementation flaw causes data to be disclosed across a security boundary without authorization. In this case, the same-origin policy - Chrome's foundational isolation mechanism preventing one origin from reading another's data - is partially bypassed through the Passwords component during specific user-driven interactions. The EUVD entry EUVD-2026-34732 confirms the affected version range as all Chrome desktop releases prior to 149.0.7827.53. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the leakage path is purely confidentiality-affecting with unchanged scope, meaning the attacker cannot pivot into other system components through this bug alone.
RemediationAI
The primary fix is upgrading Google Chrome to version 149.0.7827.53 or later, as detailed in the Google stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default; enterprise administrators using managed deployments (Google Admin console, group policy) should verify that update propagation has completed across their fleet. No vendor-documented workarounds exist for this specific vulnerability. As a compensating control in environments where immediate patching is delayed, disabling Chrome's built-in Passwords/autofill feature via enterprise policy (PasswordManagerEnabled=false) would eliminate the attack surface at the cost of removing credential autofill functionality for end users. Alternatively, enforcing user training to avoid performing credential-related interactions on unfamiliar or untrusted pages reduces social engineering effectiveness. The Chromium issue tracker entry at https://issues.chromium.org/issues/501685207 may provide additional technical detail once the vendor lifts disclosure restrictions following broad patch adoption.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today