EUVD-2026-50646
GHSA-2m9v-v5xv-4m6m
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network vector, no privileges needed, user must visit the page (UI:R); only partial cross-origin data disclosure with no integrity or availability impact (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.
Technical ContextAI
Opaque Response Blocking (ORB) is a Chrome security mechanism that extends CORB (Cross-Origin Read Blocking) to prevent web pages from reading cross-origin network responses that the browser deems 'opaque' - responses that belong to a different security origin and would normally be blocked from script access. The vulnerability is classified under CWE-346 (Origin Validation Error), indicating the root cause is an improper or incomplete check of the response's origin before permitting access. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases before the fixed version 151.0.7922.72. When ORB logic is incorrectly implemented, an attacker can craft HTTP responses or HTML that cause the browser to misclassify a cross-origin resource as accessible, leaking its contents to the attacker's JavaScript context.
RemediationAI
The primary fix is to update Google Chrome to version 151.0.7922.72 or later, which contains the corrected ORB implementation. The vendor-released patch is documented in the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprises managing Chrome via policy can use Chrome Browser Cloud Management or group policy to enforce the minimum version. As a compensating control while patching is staged, disabling JavaScript execution via Chrome's site settings or deploying a content security policy that restricts cross-origin fetches on sensitive internal applications reduces the attack surface, though these controls may break legitimate web functionality. There are no known side effects to applying the browser update itself.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today