EUVD-2026-40647
GHSA-xrfj-3w44-vqfw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery with mandatory user page visit (UI:R, PR:N); SOP bypass yields limited cross-origin write capability only (I:L), with no confidentiality or availability impact confirmed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) enables remote attackers to violate cross-origin isolation by delivering a crafted HTML page to a victim user. The flaw originates in Blink's insufficient validation of untrusted input (CWE-20), resulting in a limited integrity impact when a user browses to attacker-controlled content. No active exploitation is confirmed - SSVC classifies exploitation as none, EPSS sits at 0.22% (13th percentile), and the vulnerability is absent from CISA KEV - and a vendor patch has been released in Chrome 150.0.7871.47.
Technical ContextAI
Blink is the HTML rendering and DOM engine embedded in all Chromium-based browsers, responsible for parsing markup, executing scripts, and enforcing browser security boundaries including the same-origin policy (SOP). SOP prevents scripts loaded from one origin from reading or modifying resources belonging to a different origin, and its bypass is a foundational web security concern. CWE-20 (Improper Input Validation) identifies the root cause: Blink fails to sufficiently sanitize or reject attacker-crafted HTML constructs before processing them, allowing cross-origin restrictions to be circumvented. The affected product is Google Chrome across all platform variants, as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all versions prior to 150.0.7871.47. The SUSE tag indicates downstream Chromium packages distributed by SUSE Linux are also likely affected pending their own package update.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patch confirmed by Google's stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy management tools. SUSE Linux administrators should apply the Chromium package update from their distribution's security channel once available, as the SUSE tag indicates downstream exposure. As a compensating control prior to patching, organizations can deploy web content filtering or DNS-based blocking to prevent users from reaching unknown or untrusted external HTML pages; this reduces but does not eliminate risk if internal applications render untrusted HTML. Enabling Chrome's Enhanced Safe Browsing provides some defense against known malicious pages but is not a substitute for applying the patch. No workaround eliminates the underlying Blink input validation deficiency without upgrading.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today