EUVD-2026-40732
GHSA-v7xc-8mfr-8qcx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Renderer-process compromise is a hard prerequisite raising AC to H; confidentiality impact is partial (cross-origin data leak only), no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data via a specially crafted HTML page. This is a chained vulnerability - renderer-process compromise is a hard prerequisite, meaning real-world risk is substantially lower than the network-accessible CVSS vector implies. No public exploit code has been identified and EPSS sits at the 7th percentile (0.17%), consistent with limited exploitation interest. Google has released a fix in the stable channel update to 150.0.7871.47.
Technical ContextAI
The affected component is Chrome's Network layer, which handles requests originating from the renderer process. CWE-20 (Improper Input Validation) identifies the root cause: the Network code insufficiently validates input passed from a compromised renderer, allowing cross-origin data to be read in violation of the Same-Origin Policy. Chrome's multi-process architecture isolates renderers from privileged browser components, but this vulnerability represents a partial breakdown of that boundary when the renderer is already under attacker control - the Network component trusts renderer-supplied data it should reject or sanitize. Affected CPE corresponds to Google Chrome on desktop platforms prior to version 150.0.7871.47 across all supported operating systems.
RemediationAI
The vendor-released patch is Google Chrome 150.0.7871.47, available via the stable channel update announced at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users and enterprise administrators should update to 150.0.7871.47 or later using Chrome's built-in update mechanism or enterprise deployment tooling (e.g., Google Update, Intune, JAMF). Because exploitation requires a prior renderer compromise, organizations that enforce Chrome's Site Isolation feature (enabled by default in modern Chrome) and deploy renderer sandboxing policies gain a meaningful compensating control - the attacker's ability to escalate from renderer to Network-layer cross-origin data access is contingent on sandbox integrity. No workaround substitutes for patching; the isolation boundary is a hardening layer, not a complete mitigation against a fully chained exploit.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today