EUVD-2026-50603
GHSA-8487-52vc-ggw6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malicious HTML page exploiting WebMCP
-
DeliveryHost page or inject via malvertising
-
ExploitLure victim to visit page in unpatched Chrome
-
InstallBrowser processes page and invokes WebMCP
-
C2Origin validation check bypassed
-
ExecuteCross-origin integrity policy violated
-
ImpactAttacker achieves unauthorized cross-origin writes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72 with the WebMCP component active (the feature present in Chrome 151.x desktop builds). The attack requires user interaction: the victim must visit a specially crafted HTML page (UI:R per the CVSS vector), which must be delivered via social engineering, malvertising, or a compromised web resource. PR:N confirms no attacker-side authentication or privilege is required. The Chromium bug tracker issue (https://issues.chromium.org/issues/519500882) is linked but may be access-restricted, so precise triggering conditions beyond 'crafted HTML page' are not publicly confirmed from available data. Exploitation is limited to Chrome desktop; no mobile or server-side deployment surface is specified. |
| Impact | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-reachable, low-complexity attack with no privilege requirement but mandatory user interaction; the scope is unchanged and confidentiality is unaffected while integrity is rated High. EPSS sits at 0.19% (9th percentile), indicating very low current exploitation probability despite the moderate CVSS. The vulnerability is not listed in CISA KEV, and no POC has been identified from the available intelligence. Chromium's own severity classification of 'Medium' aligns with the real-world risk signal from EPSS. The user interaction requirement (UI:R) meaningfully raises the exploitation bar, requiring a social engineering or malvertising step. Overall, this is a real but not urgently critical vulnerability - it warrants patching in the normal update cycle rather than emergency response, unless subsequent intelligence shows exploitation activity. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures a victim running an unpatched Chrome browser to visit it, for example via phishing email or malicious advertisement. Upon page load, the crafted content exploits the WebMCP origin validation gap to perform cross-origin write operations that would ordinarily be blocked by same-origin policy, enabling the attacker to tamper with the integrity of cross-origin content accessible through the browser session. No public proof-of-concept exploit code has been identified at time of analysis, making opportunistic mass exploitation less likely at present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-patched release via the stable channel update advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver the patch automatically on supported platforms; administrators managing enterprise fleets should verify rollout via Chrome Browser Cloud Management or Group Policy. If immediate upgrade is not possible, disabling or restricting access to the WebMCP feature via enterprise policy would reduce exposure, though this may impair MCP-dependent browser functionality. Users should also apply standard browser hygiene - avoiding untrusted or unsolicited links - to reduce the likelihood of being directed to a crafted HTML page while unpatched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebMCP is Google Chrome's integration layer for the Model Context Protocol (MCP), a relatively new browser feature appearing in Chrome 151.x. CWE-346 (Origin Validation Error) identifies the root cause: the browser fails to adequately validate origin when enforcing cross-origin policies within this subsystem, permitting a crafted page to interact with or influence resources it should be barred from accessing. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop releases prior to the fixed build 151.0.7922.72. The same-origin policy is a foundational browser security primitive; bypassing it through WebMCP's policy enforcement gap allows cross-origin integrity violations that would ordinarily be blocked.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted page requires user visit (UI:R); no auth needed; SOP bypass yields high integrity impact with no confidentiality or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB