EUVD-2026-50632
GHSA-gf76-8fvr-h9hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryVictim or automated pipeline loads page in Headless Chrome
-
ExploitHeadless SOP validation logic bypassed (CWE-346)
-
ExecutionAttacker script reads or modifies cross-origin resource
-
ImpactIntegrity of target origin compromised
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation specifically requires that the target application is running Google Chrome in Headless mode - the vulnerable code path exists in the Headless component and is not confirmed to affect standard interactive Chrome. A victim system or automated pipeline must load a crafted HTML page provided or influenced by the attacker (UI:R), meaning interactive browser exploitation requires social engineering or a redirect mechanism, while automated Headless pipelines processing untrusted URLs satisfy this condition trivially. No authentication is required (PR:N) and no special server-side configuration beyond the use of Headless mode is needed. Exploitation is limited by: (1) the Headless-specific code path rather than all Chrome deployments, (2) mandatory interaction with the attacker-supplied HTML, (3) no scope change (S:U) confining impact to the browser's current context, and (4) no confidentiality impact - the bypass enables integrity violations, not data exfiltration per the CVSS signal. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N: the attack is network-reachable with low complexity and no required privileges, constrained only by the need for user or pipeline interaction (UI:R) and limited to an integrity-only impact with no scope change. EPSS at 0.19% (9th percentile) is low, indicating limited observed exploitation probability at time of analysis. There is no CISA KEV listing and no known public POC, suggesting this is not currently being mass-exploited. The high integrity impact (I:H) is real: SOP bypass enables cross-origin data tampering or unauthorized interaction with authenticated sessions. The key risk amplifier is deployment in automated Headless Chrome pipelines that process attacker-influenced HTML without human review, where UI:R is trivially satisfied. Defenders should prioritize patching in CI/CD and scraping infrastructure over end-user browser updates, where standard Chrome's mitigations may differ. |
| Exploit ScenarioDerived | An attacker hosting a crafted HTML page directs a CI/CD pipeline or automated testing harness running unpatched Headless Chrome to load that page - satisfying the UI:R requirement without human involvement. Once loaded, the page exploits the SOP bypass to interact with or modify cross-origin resources accessible in that browser context, such as session state from an adjacent authenticated web service. No public POC has been identified, but AC:L indicates a technically capable attacker could develop one without significant barrier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, as detailed in the Google Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations running Headless Chrome in automated pipelines (CI/CD, scraping, server-side rendering), ensure the updated binary is deployed to all nodes processing HTML input - these environments satisfy UI:R passively and represent the highest-risk deployment pattern. As a compensating control prior to patching, restrict Headless Chrome pipelines to processing only fully trusted, internally generated HTML; adding an allowlist or sandboxing layer around what URLs and HTML sources Headless Chrome is permitted to load reduces the attacker's ability to deliver the crafted page. Note that disabling Headless mode entirely would eliminate the vulnerable code path but would break dependent automation workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) identifies the root cause: Chrome's Headless mode fails to correctly enforce the Same-Origin Policy (SOP), the fundamental browser security boundary preventing scripts from one origin from accessing or modifying resources belonging to a different origin. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Google Chrome releases prior to 151.0.7922.72. Headless Chrome is a server-side, UI-less rendering mode widely used in automated testing pipelines, CI/CD systems, web scraping services, and server-side HTML rendering - contexts where untrusted or semi-trusted HTML input is routinely processed without direct human oversight, making SOP enforcement especially critical.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
SOP bypass via crafted HTML requires user or pipeline-triggered page load (UI:R, PR:N); impact is integrity-only (I:H) with no confidentiality, availability, or scope-change consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB