EUVD-2026-50592
GHSA-7g7q-x3jc-wh3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML/CSS page
-
DeliveryVictim navigates to malicious page in unpatched Chrome
-
ExploitCSS engine processes cross-origin resource reference
-
ExecutionOrigin validation boundary bypassed via CWE-346 flaw
-
PersistPartial cross-origin data inferred or exfiltrated
-
ImpactData returned to attacker
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that the victim is using Google Chrome on a version prior to 151.0.7922.72 and actively navigates to an attacker-controlled or compromised web page containing the crafted HTML/CSS payload - confirmed by the CVSS UI:R metric. For meaningful data to be leaked, the victim's browser must have an active session or accessible cross-origin resource at the targeted origin; without that, the leakable data is minimal. No special server-side configuration of Chrome is required. The attack is non-automatable per SSVC, ruling out mass-scale exploitation without per-victim interaction. Exploitation is further limited by the confined confidentiality impact (C:L): only partial cross-origin data is exposed, not full origin content. No authentication to the attacker's infrastructure is required. |
| Impact | The CVSS 3.1 score of 4.3 (Medium) reflects a network-reachable attack (AV:N) with low complexity (AC:L) and no authentication requirement on the attacker side (PR:N), but mandates victim user interaction via page navigation (UI:R). Impact is limited to partial confidentiality exposure (C:L) with no integrity or availability consequence. EPSS at 0.18% (8th percentile) strongly corroborates low exploitation probability and is consistent with SSVC's assessment of exploitation status as none, non-automatable attack mechanics, and only partial technical impact. The vulnerability is not listed in CISA KEV and no POC has been identified. Taken together, these signals characterize this as a real but lower-priority issue: the attack surface is wide (ubiquitous browser, any website can serve the payload), but the data exposure is limited, user interaction is required, and mass automated exploitation is not feasible per SSVC. Organizations should prioritize the Chrome update as part of routine patch cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts an HTML page embedding CSS that exploits Chrome's origin validation flaw to infer or extract data belonging to a cross-origin resource the victim's browser has access to - for example, inferring authenticated state or partial content from a co-visited origin. The victim is directed to the attacker's page via phishing, a malicious advertisement, or a compromised website, and the data exfiltration occurs silently during page rendering without further interaction. No public exploit code has been identified at the time of analysis, and the non-automatable SSVC rating indicates targeted rather than mass exploitation is the more realistic threat model. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. No public exploit code has been identified, SSVC rates exploitation as none, and EPSS sits at 0.18% - all consistent with low near-term exploitation likelihood.
RemediationAI
The primary fix is to upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this to most end-user systems automatically; enterprise environments using managed deployment (Google Admin Console, SCCM, Intune) should push the update through their standard patch pipeline. As a compensating control where immediate patching is not possible, enforcing strict Content Security Policy headers (particularly frame-ancestors and default-src restrictions) on sensitive web properties can reduce the attack surface by limiting cross-origin interactions at the application layer, though this does not eliminate the CSS-layer leak within Chrome itself and is not a substitute for patching. No workarounds that fully mitigate the underlying CSS origin validation flaw are available without applying the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Google Chrome's CSS implementation and is rooted in CWE-346 (Origin Validation Error), a class of flaws where software fails to properly enforce origin boundaries when processing or rendering resources. CSS features such as cross-origin font metric inference, computed style side-channels, or CSS custom property leakage have historically enabled browsers to inadvertently expose information about cross-origin resources, bypassing the Same-Origin Policy at the rendering layer rather than at the network layer. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72. The Chromium issue tracker reference (https://issues.chromium.org/issues/518103887) may contain further technical detail but its public accessibility is not confirmed from available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Web-delivered payload requires victim navigation (UI:R, PR:N); limited cross-origin data exposure only with no integrity or availability impact (C:L, I:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB