EUVD-2026-50601
GHSA-2pp4-fggf-q8fx
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page (AV:N), no privileges needed (PR:N), user navigation required (UI:R); Media Router flaw enables cross-origin integrity violation but not data disclosure or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
Technical ContextAI
The vulnerability resides in Chrome's Media Router subsystem, the component responsible for facilitating communication with cast-compatible devices (e.g., Chromecast endpoints) and handling media routing requests across browser contexts. CWE-346 (Origin Validation Error) identifies the root cause class: the implementation fails to properly validate the origin of requests or messages processed by the Media Router, allowing a cross-origin HTML page to issue interactions that should be restricted to the same-origin context. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome desktop installations prior to the fixed build are in scope. This class of flaw is consistent with browser IPC or Mojo interface misuse, where insufficient origin checks on privileged browser-process-side handlers allow renderer-process content from a foreign origin to trigger protected operations.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most desktop Chrome installations update automatically; administrators managing enterprise fleets should verify rollout via Google Admin Console or equivalent MDM tooling. As a compensating control pending patch deployment, organizations may consider disabling or restricting access to Media Router features via Chrome enterprise policy (e.g., EnableMediaRouter=false), though this will disable Chromecast and related casting functionality - a trade-off relevant only for environments that do not rely on media casting. Restricting users to known-safe browsing lists via web proxy can reduce exposure to crafted attacker-controlled pages but is not a substitute for patching.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today