EUVD-2026-50582
GHSA-3xr2-3348-786h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryVictim clicks link and visits page
-
ExploitChrome Passwords component invoked
-
ExecutionOrigin validation check bypassed
-
ImpactCross-origin password-related data leaked to attacker origin
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that the victim is running Google Chrome prior to version 151.0.7922.72 and visits an attacker-crafted HTML page (UI:R - active user interaction is mandatory). The CVSS vector confirms the attack is unauthenticated from the attacker's side (PR:N) and network-delivered (AV:N), but the victim must navigate to the malicious page - drive-by without any click is not confirmed. The vulnerability is specific to Chrome's Passwords component, meaning the attack surface is limited to behaviors triggered in the context of that subsystem (e.g., pages that invoke autofill or password-related APIs). Scope is unchanged (S:U), so exploitation does not escape the browser sandbox or affect other system components. Impact is limited to low confidentiality disclosure; integrity and availability are unaffected. |
| Impact | The CVSS 3.1 score of 4.3 (Medium) reflects a network-delivered attack requiring user interaction (UI:R) with limited confidentiality impact (C:L) and no integrity or availability impact. The EPSS score of 0.17% at the 7th percentile indicates very low probability of observed exploitation in the near term, consistent with the SSVC assessment of exploitation: none and technical impact: partial. KEV status is absent, and no public exploit or POC has been identified. SSVC also flags automatable: no, meaning mass-exploitation campaigns are unlikely without significant attacker effort per target. The real-world risk is therefore lower than headline CVSS might suggest: while Chrome's ubiquity creates a large theoretical attack surface, the combination of required user interaction, low confidentiality impact, and absence of any exploitation signal makes this a patch-on-schedule rather than emergency-response priority for most organizations. |
| Exploit ScenarioDerived | An attacker hosts a specially crafted HTML page and distributes the link via phishing, malicious ads, or social engineering. When a Chrome user (prior to 151.0.7922.72) visits the page, the malicious content triggers the origin validation flaw in Chrome's Passwords subsystem, causing credential-related data from a cross-origin context to leak back to the attacker's page. No public exploit code has been identified, and the attack requires the victim to actively visit the attacker-controlled page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Passwords component (prior to 151.0.7922.72) allows a remote attacker to read credential or password-related data across origin boundaries by enticing a user to visit a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the Passwords feature, where Chrome fails to properly enforce same-origin constraints. No public exploit code has been identified and SSVC signals no known active exploitation, placing this in the medium-priority tier despite Chrome's ubiquitous deployment footprint.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update to Chrome 151.0.7922.72 or later via the browser's built-in update mechanism (chrome://settings/help) or via enterprise software management tools. The vendor stable-channel release notes are available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations that cannot immediately update, a compensating control is to disable Chrome's built-in password manager (chrome://settings/passwords → toggle off 'Offer to save passwords'), which reduces the attack surface of the Passwords component at the cost of losing autofill convenience; users would need an alternative credential manager. Restricting navigation to untrusted or unsolicited HTML pages via URL filtering or Safe Browsing enforcement also limits exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) describes a failure to correctly determine or enforce the origin of a request or resource, undermining the browser's same-origin policy. In this case, the flaw resides specifically in Chrome's Passwords subsystem - the component responsible for managing saved credentials, autofill suggestions, and password-related UI. An inappropriate implementation within that component allows a crafted HTML page to trigger cross-origin data exposure, potentially leaking autofill state, credential hints, or other password-related signals to an attacker-controlled origin. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72 across platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N/AC:L/PR:N); user must visit the page (UI:R); impact is limited to partial cross-origin data disclosure with no integrity or availability effect (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB