EUVD-2026-50651
GHSA-3wq4-w788-rhg3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim on Linux Chrome visits page
-
ExploitVictim interacts with page triggering Editing subsystem
-
ExecutionCross-origin data boundary bypassed
-
ImpactLimited cross-origin data exfiltrated to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is limited to Google Chrome running on Linux - Chrome on Windows and macOS is not affected. The CVSS vector PR:L indicates the attacker requires some level of privilege or authenticated context (e.g., the victim must be logged into a service the crafted page can interact with, or the attacker controls a low-privilege origin). UI:R requires active victim interaction with a crafted HTML page - fully automated, drive-by exploitation without any user action is not possible. The confidentiality impact is Low (C:L), meaning only partial or limited cross-origin data is exposed rather than full session tokens or credential material. Non-Linux Chrome deployments are explicitly out of scope, and the interaction requirement prevents scripted mass exploitation. |
| Impact | All available signals converge on genuinely low priority. The CVSS base score is 3.5 (Low), driven by PR:L (requires some privilege), UI:R (requires victim interaction), S:U (no scope change), and C:L (limited confidentiality impact only). EPSS at 0.17% places this in the 7th percentile - statistically, fewer than 1 in 600 vulnerabilities at this score sees exploitation within 30 days. There is no CISA KEV listing and no public POC. The Linux platform restriction further reduces the realistic attacker surface relative to the full Chrome install base. The chromium security team itself rated this 'Low.' The only non-trivial signal is the network-accessible delivery vector (AV:N/AC:L), meaning a malicious web page is sufficient delivery - but this is neutralized by the required user interaction and authentication prerequisites. This is a patch-during-normal-cycle issue, not an emergency. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that triggers Chrome's Editing subsystem on a Linux host to inadvertently expose data from a cross-origin resource - for example, content from a tab or frame the victim is authenticated to. The victim must visit and actively interact with the attacker's page (e.g., clicking, selecting text, or pasting), after which limited cross-origin data is returned to the attacker. No public POC exists, making this attack currently theoretical in the absence of custom tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
RemediationAI
Update Google Chrome on Linux to version 151.0.7922.72 or later via the stable channel, as detailed in the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will apply this for most end users; enterprise deployments using managed policies should confirm the update has propagated. As a compensating control prior to patching, enabling Chrome's Strict Site Isolation (chrome://flags/#enable-site-per-process) can limit cross-origin data exposure by isolating renderer processes per origin, though this may increase memory usage. Given the Low severity, PR:L requirement, and user-interaction dependency, this fix is appropriate for inclusion in the next standard patch cycle rather than emergency deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chromium's Editing component - the subsystem responsible for clipboard operations, text selection, drag-and-drop, and contenteditable handling - specifically on the Linux platform. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as a failure to enforce information boundaries: the editing subsystem improperly permits cross-origin data to become observable to an attacker-controlled page, violating the Same-Origin Policy. This is a platform-specific defect; the CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) applies broadly but the description explicitly scopes impact to Linux. The Chromium issue tracker entry (https://issues.chromium.org/issues/497251066) is the upstream reference for the root-cause defect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted HTML page justifies AV:N; PR:L reflects authenticated context needed for cross-origin leakage; UI:R for required victim interaction; C:L for limited data exposure only.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB