EUVD-2026-40632
GHSA-378g-rr79-9cqw
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), but specific UI gestures raise complexity (AC:H); no auth needed (PR:N); only partial cross-origin confidentiality leak with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's DataTransfer implementation on macOS exposes sensitive content from one origin to an attacker-controlled page by exploiting improper boundary enforcement during user-driven UI gestures such as drag-and-drop. Versions prior to 150.0.7871.47 on Mac are affected; the flaw is platform-specific to macOS, limiting scope. No public exploit has been identified and SSVC assessment confirms no current exploitation, though successful abuse would silently exfiltrate cross-origin data without triggering typical security warnings.
Technical ContextAI
The DataTransfer Web API governs data movement during browser drag-and-drop operations and clipboard interactions. On macOS, Chromium's implementation contains an inappropriate boundary check that fails to correctly enforce cross-origin isolation when data is transferred between origins during certain gesture sequences. CWE-352 (Cross-Site Request Forgery) is the assigned weakness class, likely reflecting the UI-gesture-driven confusion attack pattern - though the primary impact (cross-origin data leakage) aligns more closely with CWE-346 (Origin Validation Error) or CWE-200 (Information Exposure); the CSRF classification may be approximate. The affected CPE corresponds to Google Chrome prior to 150.0.7871.47 exclusively on the Mac platform, suggesting a macOS-specific code path in Chromium's DataTransfer internals that diverges from the Windows/Linux implementation.
RemediationAI
Update Google Chrome on macOS to version 150.0.7871.47 or later immediately; this is the vendor-released patch confirmed by the Chrome stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should apply the patch automatically on most managed and consumer endpoints - verify via chrome://settings/help. If immediate updating is not possible, restrict user browsing to trusted origins through enterprise policies (e.g., URLBlocklist), disable drag-and-drop interactions via content security policies where feasible, or restrict access to untrusted web content on affected Mac endpoints. Note that blocking all drag-and-drop at the OS or browser level significantly degrades usability and is not recommended as a long-term control. There is no known workaround that eliminates the vulnerability without patching.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today