EUVD-2026-44485
GHSA-gc92-vpv6-2c4w
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics follow the official vector since network delivery and user interaction are confirmed.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation input validation bypass in Google Chrome prior to 150.0.7871.125 enables a remote attacker who has already compromised the renderer process to circumvent navigation restrictions through a crafted HTML page. The flaw is classified as a second-stage, chained exploit - the attacker must first achieve renderer process compromise before this vulnerability becomes exploitable. With integrity rated High (I:H) and no confidentiality or availability impact, the practical danger is unauthorized navigation control, potentially enabling redirect-based phishing, cross-origin frame manipulation, or security boundary bypass. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability stands at 0.26% (17th percentile), consistent with low current threat activity.
Technical ContextAI
The affected component is the Navigation subsystem of Google Chrome's multi-process browser architecture, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions prior to 150.0.7871.125. Chrome isolates web content in sandboxed renderer processes separated from the privileged browser process; the Navigation stack is the mechanism by which renderer processes request URL loads and cross-origin transitions, subject to strict security policy enforcement. CWE-20 (Improper Input Validation) at the root cause indicates that Chrome's Navigation layer fails to adequately validate attacker-controlled input arriving from a compromised renderer, allowing that renderer to supply crafted navigation data that bypasses policy checks such as Content Security Policy enforcement, same-origin navigation guards, or frame navigation restrictions. This class of flaw is distinct from a fully remote unauthenticated bug - it is a sandbox escape precursor that amplifies an existing renderer compromise.
RemediationAI
Update Google Chrome to version 150.0.7871.125 or later via the browser's built-in update mechanism (Help > About Google Chrome) or enterprise deployment tools (Google Update / SCCM). The vendor-released patch is confirmed available per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html. Because exploitation requires a pre-existing renderer compromise, organizations should treat this as part of broader Chrome patch hygiene rather than an emergency hotfix. As a compensating control where immediate updates are delayed, enforcing Chrome's Site Isolation policy (already default in current builds) limits renderer process access to navigation APIs across origins; however, this does not eliminate the vulnerability and is not a substitute for patching. Chromium-derived browser vendors should be monitored for corresponding patch releases.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today