EUVD-2026-40803
GHSA-w2gv-3xq6-w58f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-reachable via crafted page (AV:N), no complexity or privileges needed by attacker (AC:L/PR:N), but victim must perform UI gesture (UI:R); impact is confidentiality-only partial data leakage (C:L/I:N/A:N), no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's DevTools component (all versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive cross-origin information by convincing a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from CWE-20 (Improper Input Validation) within DevTools, allowing the Same-Origin Policy to be bypassed under attacker-directed user interaction. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS is 0.18% (8th percentile), and the vulnerability is absent from the CISA KEV catalog - with a vendor-released patch available as Chrome 150.0.7871.47.
Technical ContextAI
The vulnerability resides in Google Chrome's DevTools subsystem - the built-in browser toolset used for inspecting, debugging, and profiling web content. The root cause is CWE-20 (Improper Input Validation): DevTools fails to adequately validate untrusted input derived from attacker-crafted HTML before processing it, allowing cross-origin data to escape the Same-Origin Policy boundary. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop installations prior to 150.0.7871.47. The SUSE tag in the intelligence data indicates downstream Chromium packages on SUSE-based Linux distributions are also in scope. Because DevTools operates with elevated browser privileges and can inspect page internals across contexts, input validation failures in this component carry higher data-exposure risk than equivalent flaws in standard renderer code.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later, which is the vendor-released patch per the Chrome Stable Channel Update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will handle this silently for most consumer deployments; confirm the update by checking chrome://settings/help. For enterprise environments managing Chrome via Google Admin Console, Google Workspace, or MDM policy, push a minimum version requirement of 150.0.7871.47 to all managed endpoints. SUSE-based Linux administrators should apply the Chromium package update via zypper or equivalent once the patched package is published by the distribution maintainer. As a compensating control prior to patching, enterprises can set the Chrome enterprise policy DeveloperToolsAvailability to Disallow (value 2), which eliminates the DevTools attack surface entirely - the trade-off is that developers and support staff lose access to browser debugging tools, so this should be scoped to non-developer user groups where feasible.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today