EUVD-2026-50620
GHSA-wvwr-3hfj-vc2v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker server
-
DeliveryLure target Chrome user to visit page
-
ExploitInduce user to perform specific UI gestures
-
ExecutionChrome Passwords component violates origin boundary
-
PersistCross-origin credential data leaks to attacker page
-
ImpactAttacker reads exfiltrated data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires three simultaneous conditions: (1) the target must be running Google Chrome prior to version 151.0.7922.72; (2) the attacker must successfully social-engineer the user into visiting a crafted HTML page; and (3) the user must perform 'specific UI gestures' on that page - the exact gestures are undisclosed but the CVSS UI:R metric confirms they are mandatory and non-trivial, ruling out passive drive-by exploitation. The PR:N CVSS metric confirms no attacker authentication is required. Exploitation is further limited by: the data exposure being restricted to cross-origin data accessible via the Passwords component (not arbitrary memory), the unchanged scope (S:U) preventing lateral pivot to other browser processes, and the reliance on social engineering to trigger the UI interaction chain. Chrome's auto-update behavior also limits the window of exposure for patched users. |
| Impact | The CVSS 4.3 Medium score is consistent with the limited impact profile: C:L (low confidentiality), I:N, A:N, S:U. The mandatory user-interaction requirement (UI:R) acts as a meaningful exploitation barrier, preventing automated mass exploitation. EPSS at 0.18% in the 8th percentile aligns with this assessment - real-world exploitation attempts are unlikely to be widespread. No CISA KEV listing and no public exploit code further confirm this is not a priority-zero emergency. The primary realistic risk is targeted social-engineering attacks against specific individuals, particularly those using Chrome's Passwords/autofill feature with stored credentials. There is no signal conflict: CVSS, EPSS, KEV status, and the absence of a POC all consistently indicate a lower-priority vulnerability that warrants patching in the normal update cycle rather than emergency response. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page designed to trigger Chrome's Passwords component via user UI interactions - for example, a fake login form that prompts the user to click or interact with a field, inadvertently invoking the autofill/password-suggestion mechanism. The origin-validation flaw causes Chrome to expose cross-origin credential-related data back to the attacker's page JavaScript, which the attacker can then exfiltrate. No public exploit code exists, making this scenario most plausible in targeted rather than opportunistic attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, as released in the stable channel update documented at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should deliver this automatically; confirm the installed version via chrome://settings/help. Enterprise administrators managing Chrome via group policy or endpoint management platforms (e.g., Google Admin, Intune) should push the 151.0.7922.72 channel update immediately. Prior to patching, a targeted compensating control is to disable Chrome's built-in Passwords/autofill feature under chrome://settings/autofill, which removes the vulnerable component from the attack surface; note this disables credential autofill and may impact productivity. Users should also exercise caution when prompted to interact with UI elements on unfamiliar or untrusted pages.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-346 (Origin Validation Error): Chrome's Passwords component fails to enforce correct origin boundaries during certain UI-driven interactions, allowing data from one origin to be read by a cross-origin attacker-controlled page. This likely manifests in autofill or credential-suggestion logic, where the Passwords subsystem surfaces data based on user UI events without adequately validating the requesting origin. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) spans all desktop platforms. The Chromium issue tracker entry (https://issues.chromium.org/issues/521938924) is the upstream bug report, though access may be restricted pending broader patch adoption. The CVSS vector AV:N/AC:L confirms the attack is delivered over the network with no special conditions beyond the user interaction requirement.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N); mandatory specific UI gestures required (UI:R); impact limited to low cross-origin data disclosure with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB