EUVD-2026-40710
GHSA-fgg3-fxgg-9482
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC raised to H because exploitation explicitly requires a prior renderer process compromise as a chained precondition, not reflected in NVD's AC:L assignment.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to bypass same-origin policy protections and exfiltrate sensitive cross-origin data via a crafted HTML page. This vulnerability functions as a second-stage exploit primitive within a chain - it does not enable initial access but extends the impact of an existing renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.21% (11th percentile) reflects low observed exploitation activity.
Technical ContextAI
Google Chrome uses a multi-process architecture in which the renderer process (responsible for parsing and executing web content) is sandboxed and communicates with the browser process via IPC. The Network service - which handles HTTP requests and enforces cross-origin resource restrictions - is a separate component. CWE-20 (Improper Input Validation) here indicates that the Network component fails to adequately validate untrusted input originating from a compromised renderer, allowing that renderer to send malformed or specially crafted requests that cause the Network layer to return data across origin boundaries that would otherwise be blocked by the Same-Origin Policy and CORS enforcement. Affected product identified via EUVD data as Chrome versions in the range < 150.0.7871.47.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism (Help > About Google Chrome) or through enterprise deployment tooling. The patch is documented in the Google Chrome stable channel update advisory at chromereleases.googleblog.com (June 2026). For environments where immediate patching is not feasible, consider restricting access to untrusted or high-risk web content via enterprise browser policies (e.g., URL allowlists, disabling JavaScript on untrusted origins) - note these controls impose usability trade-offs and do not address the underlying flaw. Because exploitation requires a prior renderer compromise, organizations should also treat any co-occurring Chrome renderer vulnerabilities patched in the same release as compounding risk factors and prioritize the update accordingly.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today