EUVD-2026-40623
GHSA-7wf9-w33g-3cq9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H because exploitation requires a pre-existing renderer process compromise, a non-trivial chained precondition not reflected in the official AC:L rating.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin credential data leakage in Google Chrome's Passwords component (prior to 150.0.7871.47) enables a renderer-level attacker to exfiltrate saved passwords across origins via a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-284) in Chrome's built-in password manager, exploitable only when the attacker has already achieved renderer process compromise - making this a second-stage component in an exploit chain rather than a standalone threat. No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) alongside SSVC exploitation status of 'none' confirms limited real-world exploitation activity.
Technical ContextAI
The vulnerability resides in Google Chrome's built-in Passwords (password manager) subsystem, affecting all versions below 150.0.7871.47 per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD-2026-40623. CWE-284 (Improper Access Control) identifies the root cause: Chrome fails to enforce cross-origin policy boundaries within the Passwords component when invoked from the renderer process context. Chrome's security architecture relies on renderer process sandboxing and multi-layered same-origin policy enforcement; this gap specifically in the Passwords subsystem allows an already-compromised renderer to issue requests or manipulate internal Chrome APIs that should be blocked by cross-origin controls. Chromium issue tracker entry #513046494 tracks the upstream fix. SUSE appears in the vendor tags, indicating downstream Chromium-based packaging may require separate updates.
RemediationAI
The primary fix is upgrading Google Chrome to version 150.0.7871.47 or later, as released and documented in the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism handles this automatically for most consumer and enterprise managed deployments; administrators should verify rollout completion via endpoint management tooling or Google Admin Console. As a compensating control, disabling Chrome's built-in password manager via enterprise policy (setting PasswordManagerEnabled to false) eliminates the vulnerable attack surface entirely, though this trade-off forces users to external credential storage and may degrade security posture if unmanaged alternatives are adopted. Reducing renderer compromise exposure by enforcing Chrome's strict site isolation policy (already default in 150.x) and maintaining aggressive patch cadence on all Chrome deployments limits the feasibility of the prerequisite renderer compromise step that makes this flaw reachable.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today