EUVD-2026-50599
GHSA-98h2-vjpc-f4m2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page exploiting permissions bypass
-
DeliveryHost or deliver page via phishing or malvertising
-
ExploitVictim visits page in vulnerable Chrome
-
ExecutionPermissions subsystem fails to validate origin
-
PersistSame-origin policy constraint bypassed
-
ImpactAttacker manipulates cross-origin content integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires a user running Google Chrome prior to version 151.0.7922.72 to visit an attacker-controlled or attacker-influenced HTML page - CVSS UI:R confirms active user interaction is mandatory. The attacker requires no authentication (PR:N) and no special privileges. The vulnerability is in Chrome's Permissions subsystem and is triggered by a specifically crafted HTML page; the exact triggering mechanism (e.g., a specific permissions API call, a particular framing arrangement) is not disclosed in available public data. Exploitation is limited to integrity impact against the affected origin - confidentiality (secret exfiltration) and availability impacts are not confirmed by CVSS or description. Chromium issue tracker entry 519078527 is referenced but may be access-restricted. No exploitation requires non-default Chrome configuration. |
| Impact | The CVSS 6.5 Medium score is driven by AV:N/AC:L/PR:N/UI:R - network-reachable, low complexity to craft, no attacker authentication, but requiring user interaction to visit a malicious page. Integrity impact is rated High (I:H) with no confidentiality or availability impact (C:N/A:N), meaning the attacker can manipulate cross-origin content but cannot read secrets directly. EPSS at 0.23% (14th percentile) places this in the low-priority exploitation bucket: the vast majority of Chrome vulnerabilities with this profile are never exploited at scale in the wild. There is no CISA KEV listing and no confirmed public exploit code. The requirement for UI:R meaningfully limits automated exploitation - mass campaigns are harder without a reliable drive-by trigger that does not require active user engagement beyond visiting a page. Despite Chrome's ubiquitous deployment, the combination of patch availability, low EPSS, no KEV, and UI:R dependency suggests this is a standard browser-update hygiene item rather than an emergency response priority. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page on a publicly accessible or phishing-delivered site. A Chrome user visits the page - through a phishing link, malvertising redirect, or compromised website - and the malicious page's JavaScript triggers the permissions misimplementation to bypass same-origin policy restrictions, allowing the attacker's page to perform integrity-affecting operations (such as form manipulation, state modification, or cross-origin writes) against a co-loaded or navigated target origin. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-origin policy bypass in Google Chrome's Permissions subsystem (prior to 151.0.7922.72) allows an unauthenticated remote attacker to violate cross-origin integrity constraints by inducing a user to visit a crafted HTML page. The root cause is an origin validation error (CWE-346) in Chrome's permissions implementation, where the browser incorrectly evaluates the requesting origin, enabling cross-origin integrity manipulation. No public exploit has been identified at time of analysis, and EPSS at 0.23% (14th percentile) signals low observed exploitation activity.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this in most managed and consumer environments; administrators should verify fleet update compliance via policy tooling. If immediate patching is not feasible, reducing exposure can be achieved by enforcing strict Content Security Policy headers on sensitive web properties to limit the practical impact of a SOP bypass, and by using URL filtering to block navigation to untrusted or newly registered domains. These controls do not eliminate the vulnerability but reduce the likelihood of successful exploitation against high-value targets. No other vendor workarounds are documented in available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) describes failures in properly verifying that a request or resource originates from an expected and legitimate source. In Chrome's permissions subsystem, the same-origin policy (SOP) is a fundamental browser security boundary that prevents scripts on one origin from reading or modifying resources on a different origin. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers the full Google Chrome browser application across platforms. The vulnerability reflects an 'inappropriate implementation' - not a memory corruption or logic inversion, but a subtly incorrect permission-checking code path that a specially crafted HTML page can trigger. CVSS vector S:U (Unchanged scope) indicates the bypass operates within Chrome's existing security context rather than escaping the browser sandbox entirely.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered SOP bypass needs only user page visit (UI:R, PR:N); integrity-only impact with unchanged scope matches permissions-layer bypass without sandbox escape.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB