EUVD-2026-50660
GHSA-hh43-fjwj-9j9w
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted HTML requires active user interaction (UI:R); no authentication needed (PR:N); impact is limited to partial cross-origin data disclosure (C:L) with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.
Technical ContextAI
The vulnerability resides in Google Chrome's SVG (Scalable Vector Graphics) rendering pipeline, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all versions prior to 151.0.7922.72. CWE-346 (Origin Validation Error) is the root-cause class: the browser's enforcement of the Same-Origin Policy (SOP) is incomplete when processing specific SVG constructs. SVG files are particularly complex for origin enforcement because they can embed scripts, reference cross-origin resources via filters, use-elements, or image references, and interact with the hosting document's DOM - each of these pathways must be individually gated by origin checks. A bypass in any one of these gating mechanisms allows data from an authenticated cross-origin context to be read by attacker-controlled script.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism handles this for most consumer deployments; enterprise administrators should verify rollout status via Chrome Browser Cloud Management or equivalent MDM tooling. If immediate update is not feasible, a compensating control is to restrict employee browsing to an allowlisted set of trusted sites via a forward proxy or DNS filtering layer, which reduces exposure to attacker-hosted pages exploiting this SVG vector - note that this does not eliminate risk if legitimate sites serve attacker-influenced SVG content. Disabling SVG rendering entirely is not a practical browser-level option and would break widespread legitimate content. Given no active exploitation and low EPSS, patching through standard change-management cycles is appropriate rather than emergency deployment.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today