EUVD-2026-40607
GHSA-j5j3-r8p4-3g3f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page (AV:N), no credentials needed (PR:N), victim must visit page (UI:R), integrity impact from SOP bypass but no confidentiality or availability consequence, scope unchanged (S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials component allows remote attackers to violate cross-origin isolation guarantees via a crafted HTML page. Affected are all Chrome desktop releases prior to 150.0.7871.47 on all supported platforms. Exploitation requires user interaction (visiting an attacker-controlled page) and yields high integrity impact - enabling cross-origin state manipulation - with no confidentiality or availability consequence. No active exploitation is confirmed (not in CISA KEV), EPSS is low at 0.22% (13th percentile), and SSVC rates exploitation as none with partial technical impact; a vendor patch is available.
Technical ContextAI
DeviceBoundSessionCredentials (DBSC) is a relatively modern Chrome security feature designed to cryptographically bind authentication session tokens to the specific device, mitigating session-cookie theft attacks. The flaw, classified under CWE-20 (Improper Input Validation), arises from the DBSC subsystem failing to adequately validate untrusted data from a crafted HTML page before processing it. The same-origin policy (SOP) is the browser's foundational mechanism preventing scripts on one origin from reading or manipulating resources from a different origin; bypassing it undermines the entire web security model. Because the vulnerability lives in the DBSC component - which handles session credential scope and binding - insufficient validation can produce cross-origin trust decisions based on attacker-influenced input. Affected CPE per EUVD: Chrome versions below 150.0.7871.47. The Chromium security team rated this Medium severity.
RemediationAI
The primary remediation is to update Google Chrome to version 150.0.7871.47 or later, confirmed available via the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should handle this automatically for most users; administrators managing enterprise deployments should verify rollout via Google Chrome Enterprise policies. No vendor-documented workaround is available in the provided data. As a compensating control pending patching, organizations can restrict access to untrusted external web content through browser isolation solutions or proxy-based URL filtering - this reduces the attack surface by limiting user exposure to attacker-crafted pages. Disabling the DeviceBoundSessionCredentials feature entirely via Chrome policy flags may be possible but is not confirmed in available data and could break DBSC-dependent authentication flows; this should be evaluated against operational impact before deployment.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today