EUVD-2026-40504
GHSA-wvx6-6h8r-v7gv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attacker delivers exploit via network-hosted HTML requiring user visit (AV:N, UI:R); no privileges or credentials needed (PR:N); navigation bypass yields high integrity impact with no confidentiality or availability effect (C:N/I:H/A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Navigation restriction bypass in Google Chrome's Passwords subsystem allows a remote attacker to circumvent intended access controls by delivering a crafted HTML page to a user. All Chrome desktop versions prior to 150.0.7871.47 are affected, with integrity rated High by CVSS due to the ability to manipulate navigation behavior. No public exploit exists at time of analysis and EPSS sits at 0.22% (13th percentile), indicating low near-term exploitation probability despite Chrome's enormous global footprint and Chromium's internal 'High' severity classification.
Technical ContextAI
The vulnerability exists within the Passwords component of Google Chrome's Chromium browser engine - specifically the logic governing how the built-in password manager interacts with page navigation and cross-origin or same-site navigation guards. CWE-284 (Improper Access Control) identifies the root cause class: access control checks within the Passwords subsystem are insufficiently enforced, allowing specially constructed HTML to influence navigation in ways the browser's security model is intended to prevent. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N confirms the attack is purely network-delivered, requires no attacker-side credentials, and achieves high integrity impact without scope escalation beyond the browser process. Affected versions are all Chrome desktop builds below 150.0.7871.47 per EUVD-2026-40504.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, as documented in the stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism handles this for most consumer deployments automatically; enterprise administrators using Chrome Browser Cloud Management or group policy should verify that the update has propagated across managed endpoints and confirm the running version via chrome://settings/help. No documented workaround for the navigation bypass is provided by the vendor; the patch is the only confirmed remediation. Organizations that cannot immediately patch could mitigate exposure by disabling Chrome's built-in password manager (chrome://settings/passwords) and redirecting users to a standalone password manager, though this reduces usability and does not address the underlying browser flaw - it only reduces the attack surface of the Passwords component involved in the bypass.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today