EUVD-2026-40650
GHSA-cr4m-xq2x-6f95
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory prerequisite of prior renderer compromise; NVD's AC:L materially understates real-world attack complexity for this chained scenario.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient data validation in PDF in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already achieved renderer process compromise to escape PDF-layer sandboxing controls via a crafted HTML page, circumventing browser navigation security boundaries. This is a chained-attack-only scenario: the flaw is not independently exploitable and requires a prior renderer compromise as a prerequisite. No public exploit has been identified, EPSS is 0.22% (13th percentile), and SSVC rates exploitation as none - making this a theoretical second-stage risk rather than an immediate standalone threat. Vendor-released patch is confirmed at version 150.0.7871.47.
Technical ContextAI
The vulnerability resides in Chrome's PDF processing subsystem (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and is classified under CWE-20 (Improper Input Validation). Chrome employs a multi-process sandbox architecture where renderer processes are deliberately isolated from the browser process and privileged origins to limit the blast radius of renderer-level compromises. This flaw arises when PDF content embedded in a crafted HTML page is processed with insufficient validation of navigation-related data, allowing a renderer that has already been compromised to issue navigation requests that would normally be blocked by Chrome's navigation restriction policies - such as cross-origin navigation guards or sandboxed frame restrictions. The PDF subsystem's failure to properly validate these navigation inputs is the root cause, classified as improper input validation rather than a logic or memory-safety error.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, as documented in the official vendor advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should apply this patch automatically for most consumer installations; enterprise administrators managing Chrome via policy should verify that managed deployments have reached 150.0.7871.47 using fleet management tools or Chrome Browser Cloud Management. No standalone workaround neutralizes this specific PDF input-validation flaw without patching. Defense-in-depth measures that reduce the overall exploit chain risk include ensuring Chrome's Site Isolation feature remains enabled (it is on by default in modern releases - disabling it would increase risk), and enforcing policies that restrict navigation to untrusted or unrecognized origins via enterprise Chrome policies such as URLBlocklist, which can limit the utility of a navigation bypass even if triggered. These controls mitigate impact but do not eliminate the vulnerability.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today