EUVD-2026-40741
GHSA-3m9m-rx9m-5pm3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
User must actively visit a crafted page (UI:R); navigation bypass yields only limited integrity impact with no confidentiality or availability effects and no scope change.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-layer policy enforcement by inducing a user to visit a specially crafted HTML page. Rooted in CWE-602 (client-side enforcement of server-side security), the flaw means Chrome's network policy checks governing navigation can be subverted client-side, yielding a low-integrity impact with no confidentiality or availability consequence. No public exploit has been identified and the EPSS exploitation probability stands at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating - this is a low-urgency but genuine policy-enforcement gap.
Technical ContextAI
The affected component is Chrome's Network subsystem, which enforces navigation restrictions - rules governing where the browser may or may not navigate (e.g., Content Security Policy directives, enterprise-configured URL allowlists, or internal navigation guards). CWE-602 (Client-Side Enforcement of Server-Side Security) describes the root cause class: security logic that should be authoritative on a server or in a trusted enforcement layer is instead partially or incorrectly applied on the client, allowing an adversary to craft inputs that bypass the check. Because Chrome is the client, an attacker-controlled HTML page can supply crafted navigation triggers - such as manipulated redirect chains, iframe src attributes, or scripted navigation events - that exploit the insufficient policy check. The affected product is confirmed via EUVD as all Chrome releases in the 150.x branch prior to 150.0.7871.47, across all desktop platforms (Windows, macOS, Linux) covered by the stable channel update.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later via Chrome's built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise software distribution channels; the advisory is available at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For environments where immediate patching is not feasible, compensating controls should focus on the specific attack surface: enforce navigation restrictions at the network perimeter (proxy or firewall URL filtering) rather than relying solely on Chrome's client-side policy enforcement, since this vulnerability demonstrates that client-side checks can be bypassed. In managed enterprise deployments, ensure Chrome policies are also enforced server-side or at the proxy layer to provide defense-in-depth. Disabling or restricting access to untrusted external HTML content via browser extension policy or managed profile settings can reduce exposure until the update is applied. Note that proxy-based filtering introduces latency and may affect HTTPS inspection depending on deployment.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today