EUVD-2026-40562
GHSA-wx7c-5g9f-68r4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC raised to High because 'privileged network position' (MiTM) is an explicit prerequisite; all other metrics follow the description directly.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass content security policy via malicious network traffic. (Chromium security severity: Medium)
AnalysisAI
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 is achievable by an attacker holding a privileged network position who can manipulate traffic between the victim's browser and a server. The flaw originates in Chrome's Network component (CWE-693: Protection Mechanism Failure), where an inappropriate implementation allows CSP enforcement to be circumvented via crafted network traffic, yielding a High Integrity impact. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS score of 0.15% (4th percentile) - but the attack vector is unauthenticated and the integrity impact is significant for high-value targets on adversarial networks.
Technical ContextAI
CWE-693 (Protection Mechanism Failure) identifies the root cause: Chrome's network stack contains an improper implementation of a mechanism that Content Security Policy relies upon. CSP is a browser-enforced security layer that restricts which origins a page may load scripts, styles, and other resources from - a critical XSS and data-injection mitigation. The flaw resides in Chrome's Network component, likely in HTTP response parsing or header enforcement logic, enabling a man-in-the-middle actor to inject or alter traffic in ways that cause Chrome to honor resources that CSP should have blocked. Per ENISA EUVD-2026-40562, the affected product is Google Chrome (all desktop platforms) on versions prior to 150.0.7871.47, with the fix shipped in the 150 stable channel release.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in update mechanism (chrome://settings/help) is the primary delivery path. For environments where immediate patching is not possible, enforce mandatory VPN usage for all Chrome sessions to eliminate the privileged network position required for exploitation - note this control only removes the attack surface if the VPN itself is trusted and the endpoint-to-VPN tunnel is not interceptable. Restricting users to known, monitored networks (wired enterprise LAN, private Wi-Fi with WPA3) also reduces exposure. These compensating controls do not address the underlying implementation flaw and should be treated as temporary.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today