EUVD-2026-37543Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page; AC:H for required gesture engineering; UI:R mandatory; C:L for limited cross-origin data leak only; no integrity or availability impact.
Primary rating from CISA-ADP.
CVSS VectorCISA-ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Passwords component (all versions prior to 149.0.7827.155) enables a remote attacker to extract sensitive cross-origin information by engineering a scenario where a victim performs specific UI gestures on a crafted HTML page. The flaw is an inappropriate implementation in the browser's password-related UI surface that fails to enforce cross-origin isolation boundaries under manipulated gesture sequences (CWE-451). No public exploit code or active exploitation has been identified; EPSS probability stands at 0.27% (19th percentile) and the vulnerability is absent from the CISA KEV catalog, collectively indicating low real-world exploitation urgency despite Chrome's massive deployment footprint.
Technical ContextAI
The vulnerability resides in the Passwords component of Google Chrome desktop (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), affecting all stable channel releases prior to 149.0.7827.155. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause class: the browser's password autofill or suggestion overlay logic fails to correctly enforce Same-Origin Policy boundaries when specific user gesture sequences are triggered by attacker-crafted HTML. This class of vulnerability typically manifests when UI components that handle privileged credential data can be coaxed by adversarial page content into surfacing or leaking data belonging to a different origin, bypassing the isolation guarantees users rely on. The Chromium issue tracker reference (https://issues.chromium.org/issues/517258337) likely contains additional technical specifics but may be access-restricted pending broader patch adoption.
RemediationAI
Update Google Chrome to version 149.0.7827.155 or later, which contains the vendor-released patch addressing this vulnerability. Chrome's stable channel update details are documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Chrome typically auto-updates for consumer users; enterprise administrators managing deployments via policy (e.g., Google Admin Console or Chromium-based managed browsers) should verify version propagation and enforce the minimum version via browser policy. If immediate patching is operationally infeasible, disabling Chrome's built-in password manager at chrome://settings/passwords removes the vulnerable Passwords UI surface as a compensating control, though this eliminates autofill functionality and requires users to manage credentials through an alternative means. Additionally, restricting end-user navigation to untrusted or externally hosted HTML pages via web content filtering can reduce exposure surface, but does not address the underlying flaw and should not substitute for patching.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today