EUVD-2026-36345
GHSA-h97p-mrq3-8jwj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered exploit via crafted HTML justifies AV:N; AC:H reflects renderer-compromise prerequisite; UI:R for victim interaction; C:H for cross-origin data leakage; I:N and A:N as no integrity or availability impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Network component (all versions prior to 149.0.7827.115) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data by delivering a crafted HTML page to a victim. The flaw is a two-stage attack requiring a prior renderer exploit as a prerequisite, which substantially elevates the real-world bar for exploitation. No active exploitation has been identified (SSVC: none, EPSS: 0.03%), and a vendor-released patch is available in Chrome 149.0.7827.115.
Technical ContextAI
The vulnerability resides in Chrome's Network subsystem (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), which is responsible for managing cross-origin network requests and enforcing browser security boundaries such as the Same-Origin Policy (SOP). CWE-20 (Improper Input Validation) identifies the root cause: the Network layer fails to adequately validate untrusted input received from a compromised renderer process, allowing data governed by cross-origin isolation controls to bypass expected enforcement. In Chrome's multi-process architecture, the renderer and network service operate in separate processes with inter-process communication (IPC); this flaw is exploitable when a renderer that has been compromised by a separate vulnerability sends malformed or crafted IPC messages to the Network service, causing it to return cross-origin data it should have withheld. The attack therefore functions as a sandbox escape component within a larger exploit chain rather than as a standalone network-facing flaw.
RemediationAI
Update Google Chrome to version 149.0.7827.115 or later, which is confirmed by the vendor's Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html. On most consumer systems, Chrome auto-updates; verify the installed version via chrome://settings/help and relaunch if an update is pending. For enterprise-managed deployments, push the update through Google Admin console or relevant MDM tooling. Organizations running Chromium on SUSE or Red Hat systems should apply the distribution-provided Chromium package update as soon as it is available from their respective repositories. As a compensating control while patching, ensure Chrome's Site Isolation (chrome://flags/#enable-site-per-process) remains enabled - it is on by default in recent Chrome versions and limits cross-origin data exposure from renderer-level compromises, though it does not fully remediate this specific flaw. No other workaround fully mitigates the underlying Network validation flaw without applying the vendor patch.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today