EUVD-2026-50649
GHSA-2g34-f5v9-6pvc
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
UI:R is mandatory as user must open a malicious file; C:L captures bounded cross-origin data leakage with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a malicious file. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Technical ContextAI
The vulnerability resides in the Enterprise policy implementation within Google Chrome on Windows. CWE-346 (Origin Validation Error) indicates the affected component fails to correctly validate origin boundaries, permitting cross-origin data access that the browser's same-origin policy is intended to prohibit. Chrome's Enterprise feature set manages policy-driven configurations deployed by organizations via Google Admin Console or Windows Group Policy, and its interaction with locally-opened or delivered files appears to be the surface through which this boundary check is bypassed. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions on all platforms, but NVD and the description explicitly scope the affected condition to Windows. Chromium issue 496195854 is the upstream tracking reference, though it is not publicly accessible, limiting technical detail from open sources.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, the vendor-released patch that resolves this vulnerability per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For enterprise environments managed via Google Admin Console or Windows Group Policy Object (GPO), verify that automatic updates are permitted or push version 151.0.7922.72 through your MDM or endpoint management platform. As a compensating control prior to patching, administrators can restrict end users from opening untrusted or externally sourced files directly in Chrome through Enterprise policy (e.g., blocking file:// access or restricting download-then-open workflows), though this may disrupt legitimate business processes that rely on local file rendering in Chrome. Given the low EPSS and absence of active exploitation, inclusion in the next standard patch cycle is appropriate rather than emergency deployment.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today