EUVD-2026-40479
GHSA-8xfg-jwhx-8vxp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page (AV:N/AC:L), victim must visit attacker page (UI:R/PR:N), pure data exfiltration with no integrity or availability impact (C:H/I:N/A:N), no scope change (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's SVG rendering subsystem (versions prior to 150.0.7871.47) allows remote attackers to exfiltrate sensitive information from other origins by directing victims to a crafted HTML page. The root cause is insufficient policy enforcement in SVG handling, classified as CWE-346 (Origin Validation Error), effectively bypassing Same-Origin Policy protections. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite a CVSS confidentiality impact rated High.
Technical ContextAI
The vulnerability resides in Google Chrome's SVG (Scalable Vector Graphics) rendering engine. CWE-346 (Origin Validation Error) identifies the root cause as a failure to properly validate or enforce origin boundaries when processing SVG content - SVG features such as filters, external image references, or cross-document element access may be leveraged to read data from origins that the Same-Origin Policy should prohibit. The Same-Origin Policy is a foundational browser security boundary; when SVG policy enforcement is insufficient, an attacker-controlled SVG document embedded in a crafted HTML page can trigger reads against cross-origin resources accessible to the victim's browser session. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms this is a purely client-side, network-delivered vulnerability with no scope change. Affected product confirmed by EUVD: Chrome prior to version 150.0.7871.47.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, as released in Google's stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this patch automatically on most desktop systems; enterprise administrators should verify fleet-wide rollout via Google Chrome Browser Cloud Management or equivalent MDM tooling and confirm the installed version is at or above 150.0.7871.47. As a compensating control for environments unable to patch immediately, restricting user access to untrusted web content via enterprise web proxy filtering or URL categorization can reduce exposure, though this does not remediate the underlying flaw and introduces usability trade-offs. Deploying strict Content Security Policy (CSP) headers on internally controlled web applications can limit SVG-based cross-origin reads in those contexts but provides no protection against attacker-controlled pages. The Chromium issue tracker entry at https://issues.chromium.org/issues/510829679 may provide additional technical detail for defenders implementing application-layer mitigations.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today