EUVD-2026-37531Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), victim must actively visit it (UI:R), no attacker privileges needed (PR:N); partial confidentiality leak only (C:L), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Passwords component prior to version 149.0.7827.155 enables a remote attacker to read sensitive cross-origin data by directing a victim to a crafted HTML page. The root cause is an incorrect authorization check (CWE-863) within the browser's built-in password subsystem, which improperly permits cross-origin access to data that should be origin-restricted. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.29% (21st percentile) and SSVC exploitation=none collectively indicate low near-term exploitation likelihood despite the broad user base.
Technical ContextAI
The vulnerability resides in Chrome's native Passwords component - the integrated password manager and autofill subsystem - rather than in a web-facing API or network protocol. CWE-863 (Incorrect Authorization) identifies the root cause as a failure to enforce proper authorization boundaries: specifically, the password feature processes or surfaces data without fully validating the requesting origin, violating the browser's Same-Origin Policy (SOP) guarantees. Cross-origin data leakage of this class typically occurs when an internal browser component responds to scripted or declarative triggers from a malicious page, bypassing origin checks that should be enforced at the component boundary. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all desktop Chrome releases prior to 149.0.7827.155. Tags indicating Red Hat and SUSE involvement suggest that downstream Chromium-based packages in those Linux distributions are also affected.
RemediationAI
Upgrade Google Chrome to version 149.0.7827.155 or later immediately, as detailed in the official Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome's built-in silent auto-update delivers this fix automatically for most consumer installations; enterprise administrators managing Chrome via policy should verify fleet-wide deployment using Chrome Browser Cloud Management or equivalent tools and confirm no update-blocking policies are suppressing delivery. For Red Hat Enterprise Linux and SUSE environments, monitor vendor security advisories for updated chromium package builds and apply via standard package management (dnf/zypper). No documented workaround exists for the underlying flaw itself; disabling Chrome's built-in password manager (via chrome://settings/passwords) would remove the vulnerable code path but also eliminates password autofill functionality - this trade-off is significant and the patch is strongly preferred.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today