EUVD-2026-50595
GHSA-46c6-4cmr-4c64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Chrome on Windows target
-
DeliveryDeliver renderer RCE via separate exploit
-
ExploitGain code execution in sandboxed renderer
-
ExecutionServe crafted HTML triggering Media origin validation flaw
-
PersistBypass same-origin policy
-
ImpactWrite or access cross-origin content in victim's browser
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires two stacked conditions: (1) the attacker must have already achieved code execution within Chrome's renderer process via a separate vulnerability; and (2) the victim must visit a crafted HTML page in Chrome on Windows prior to version 151.0.7922.72. The flaw is explicitly Windows-platform-specific per the CVE description. No special server-side configuration is required on the attacker's side beyond serving the crafted HTML. Limiting factors: the renderer compromise prerequisite is the dominant barrier - without it, this bug is not independently exploitable. No special browser settings, enterprise features, or non-default configurations are required beyond the platform and version constraints. |
| Impact | CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates network-delivered, user-triggered, unauthenticated exploitation with high integrity impact and no scope change. However, the description's explicit prerequisite - 'who had compromised the renderer process' - introduces a significant additional condition not fully captured by the official AC:L rating. Real-world exploitation requires either chaining this with a separate renderer RCE bug or relying on a renderer already compromised by other means, elevating practical complexity substantially above what AC:L suggests. EPSS at 0.19% (9th percentile) is consistent with low real-world exploitation activity. KEV status is not listed, and no public exploit code has been identified. The official S:U rating is arguably conservative for a SOP bypass, which by definition crosses origin security boundaries. This vulnerability is best understood as a privilege-escalation-within-sandbox primitive useful in multi-stage exploit chains (e.g., renderer RCE + SOP bypass), rather than a standalone high-severity issue. Priority for patching remains high given Chrome's ubiquitous deployment, but standalone exploitation risk is low absent a paired renderer exploit. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer RCE vulnerability to gain code execution inside Chrome's sandboxed renderer process on a Windows machine, then serves the victim a crafted HTML page that triggers the Media component's origin validation flaw, using the compromised renderer to bypass the same-origin policy and perform cross-origin writes - for example, injecting content into a banking session the victim has open in another tab. No public proof-of-concept code exists at time of analysis, so this scenario is theoretical but structurally plausible as part of a browser exploit chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
RemediationAI
Update Google Chrome for Windows to version 151.0.7922.72 or later, which contains the vendor-released patch per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this automatically for most managed endpoints; verify deployment via chrome://version or enterprise policy reporting. Because exploitation requires a pre-compromised renderer, organizations that enforce Chrome's built-in exploit mitigations (e.g., RendererCodeIntegrity on Windows, site isolation with strict origin policies) reduce the likelihood of a renderer compromise occurring in the first place, which directly limits the exploitability of this SOP bypass as a chained second stage. No workarounds are documented by the vendor that compensate for the flaw itself without applying the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) describes failures to properly verify that a resource's claimed origin matches its actual origin before granting cross-origin access. In Chrome's multi-process architecture, the renderer process sandboxes untrusted web content; same-origin policy enforcement is a critical isolation boundary between different web origins. The Media component's inappropriate implementation means that, given access to the renderer process, an attacker can craft HTML that manipulates origin checks in the Media subsystem, allowing cross-origin reads or writes that should be blocked. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to Windows only, all versions below 151.0.7922.72. This Windows-specific scoping suggests the flaw may involve a Windows-specific Media API codepath or IPC mechanism.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; S:C captures that SOP bypass crosses origin security boundaries by definition.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB