EUVD-2026-50595
GHSA-46c6-4cmr-4c64
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; S:C captures that SOP bypass crosses origin security boundaries by definition.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
Technical ContextAI
CWE-346 (Origin Validation Error) describes failures to properly verify that a resource's claimed origin matches its actual origin before granting cross-origin access. In Chrome's multi-process architecture, the renderer process sandboxes untrusted web content; same-origin policy enforcement is a critical isolation boundary between different web origins. The Media component's inappropriate implementation means that, given access to the renderer process, an attacker can craft HTML that manipulates origin checks in the Media subsystem, allowing cross-origin reads or writes that should be blocked. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to Windows only, all versions below 151.0.7922.72. This Windows-specific scoping suggests the flaw may involve a Windows-specific Media API codepath or IPC mechanism.
RemediationAI
Update Google Chrome for Windows to version 151.0.7922.72 or later, which contains the vendor-released patch per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this automatically for most managed endpoints; verify deployment via chrome://version or enterprise policy reporting. Because exploitation requires a pre-compromised renderer, organizations that enforce Chrome's built-in exploit mitigations (e.g., RendererCodeIntegrity on Windows, site isolation with strict origin policies) reduce the likelihood of a renderer compromise occurring in the first place, which directly limits the exploitability of this SOP bypass as a chained second stage. No workarounds are documented by the vendor that compensate for the flaw itself without applying the patch.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today