EUVD-2026-40746
GHSA-cvpc-8wff-778c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered crafted page requires no attacker privileges but mandates user navigation; cross-origin data leak yields high confidentiality impact with zero integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the Related-Website-Sets feature, enabling a remote attacker to read sensitive cross-origin data by delivering a crafted HTML page to a victim. The CVSS 6.5 score with High confidentiality impact reflects meaningful exposure potential, though Google internally rated this as Low severity and EPSS sits at 0.17% (7th percentile), suggesting limited real-world exploitation risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available.
Technical ContextAI
Related-Website-Sets (formerly First-Party Sets) is a Chrome privacy feature that permits a declared group of related domains to share cross-site access - including cookies, storage, and other cross-origin data - that Chrome's standard isolation policies would otherwise block. CWE-693 (Protection Mechanism Failure) identifies the root cause class: the enforcement logic governing which origins are permitted to access data across the set boundary did not correctly validate policy constraints, allowing a specially crafted page to exceed its authorized access scope. This is a browser-engine enforcement defect, not a web application flaw; the vulnerability exists within Chrome's own Blink rendering engine and its implementation of the Related-Website-Sets permission model. Affected versions are identified as Chrome for desktop prior to 150.0.7871.47 per the EUVD and Google's stable channel advisory.
RemediationAI
The primary fix is to update Google Chrome to version 150.0.7871.47 or later, as documented in the Chrome stable channel release notes at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism handles this for most consumer users automatically. Enterprise administrators managing Chrome deployments via group policy or an MDM should push version 150.0.7871.47 through their software distribution platform promptly. As a compensating control for organizations that cannot immediately update, disabling the Related-Website-Sets (First-Party Sets) feature via Chrome's FirstPartySetsEnabled enterprise policy would eliminate the vulnerable code path; however, this may break intended cross-site functionality for any internal or partner sites that rely on declared website sets, so assess business impact before applying. No other specific workarounds are confirmed from the available references.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today