EUVD-2026-50644
GHSA-ff3f-6wm3-vj2m
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), no privileges required (PR:N), but mandatory user UI gesture (UI:R); only limited cross-origin confidentiality leak, no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.
Technical ContextAI
The vulnerability resides in Chrome's DataTransfer API implementation, used to move data between drag-and-drop sources and targets or between clipboard operations. CWE-346 (Origin Validation Error) identifies the root cause: Chrome failed to properly enforce same-origin policy boundaries when a DataTransfer operation crossed origins, allowing data from one origin to be exposed to a page on a different origin. This class of flaw typically arises when browser internal state for clipboard or drag-and-drop objects is shared or insufficiently sandboxed between browsing contexts. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all Chrome desktop versions prior to 151.0.7922.72 across Windows, macOS, and Linux. The EUVD entry EUVD-2026-50644 corroborates the affected version range as all Chrome builds below 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which includes the fix for this DataTransfer origin validation error. The vendor patch is confirmed available via the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will apply this fix automatically in most managed and consumer environments; verify deployment via browser version strings in endpoint management tooling. For environments where immediate patching is not possible, organizations can reduce exposure by enforcing web content filtering to block access to untrusted or unknown HTML pages, reducing the attack surface for the required UI gesture interaction. Restricting drag-and-drop functionality via Group Policy (ChromeDragAndDropEnabled) in enterprise environments is a targeted compensating control, though it may impair legitimate productivity workflows. Chromium-derivative browsers should be tracked independently for their own patch releases.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today