EUVD-2026-50634
GHSA-4xcj-35rw-3hvj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page exploiting Paint origin validation
-
DeliveryDeliver page link via phishing or ad network
-
ExploitVictim visits page in unpatched Chrome
-
ExecutionPaint subsystem processes cross-origin resource without proper isolation
-
PersistAttacker script reads disclosed cross-origin data
-
ImpactExfiltrate captured data to attacker-controlled server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires a victim to actively navigate to or be redirected to an attacker-controlled HTML page (UI:R) using Google Chrome prior to version 151.0.7922.72. No authentication or elevated privileges are required on the attacker's side (PR:N), and the attack is delivered over the network (AV:N) with low complexity (AC:L). No special non-default browser configuration is needed - any Chrome user below the patched version who visits the crafted page is potentially affected. Exploitation is bounded by the user-interaction gate (victim must load the page) and by the impact ceiling of cross-origin data disclosure only - no code execution, privilege escalation, or data modification is achievable through this flaw alone. |
| Impact | CVSS 3.1 scores this at 4.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, reflecting a network-reachable, low-complexity flaw that requires no privileges but does require user interaction, with only partial confidentiality impact and no integrity or availability consequences. EPSS at 0.18% (8th percentile) is well below any exploitation threshold of concern, consistent with no recorded CISA KEV listing and no reported public POC. The UI:R requirement meaningfully limits fully automated or drive-by exploitation. While the attack complexity is low and no authentication is needed, the combination of required user interaction and bounded impact (data disclosure only, no code execution) places this firmly in the routine patch-cycle category rather than emergency response. No conflicting signals exist in the available data - CVSS, EPSS, and KEV absence are mutually consistent. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that abuses the Paint origin validation flaw to read data rendered from a cross-origin resource loaded in the victim's Chrome browser. The attacker distributes the page via phishing email, malicious advertisement, or compromised website and waits for a target running an unpatched Chrome version to visit it, after which cross-origin data is exfiltrated to the attacker's server. No public POC exists at time of analysis, making large-scale opportunistic exploitation unlikely in the near term. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which resolves this vulnerability per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates on consumer endpoints; enterprise administrators should verify fleet update compliance via group policy or endpoint management tooling to confirm no instances are pinned to older versions. As a temporary compensating control, content filtering policies that block navigation to untrusted or externally hosted pages reduce exposure at the cost of browsing flexibility - this is suitable only as a short-term measure until the patch is deployed. No adverse side effects from the patch itself are indicated by vendor documentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability originates in Chrome's Paint subsystem, which handles low-level rendering operations such as compositing and pixel-level drawing across browser contexts. CWE-346 (Origin Validation Error) indicates that the Paint implementation does not correctly enforce Same-Origin Policy boundaries when processing or rendering cross-origin resources, potentially exposing rendered pixel data or other origin-bound artifacts to a malicious page. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all Chrome versions across Windows, macOS, and Linux prior to the 151.0.7922.72 stable release. The Chromium issue tracker reference (issues.chromium.org/issues/523698038) provides the upstream engineering record. The flaw is classified by the Chrome security team as Medium severity, consistent with its constrained, read-only cross-origin impact and user-interaction prerequisite.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered, no auth required; victim must visit crafted page (UI:R); impact limited to cross-origin data disclosure with no integrity or availability consequence (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB