EUVD-2026-50683
GHSA-7m8x-rgjh-8gvw
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring passive user navigation; only partial confidentiality impact from cross-origin data leak; no integrity or availability impact applicable.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.
Technical ContextAI
QUIC (Quick UDP Internet Connections) is Google's application-layer transport protocol underpinning HTTP/3, implemented natively in Chrome. CWE-346 (Origin Validation Error) identifies the root cause as a failure to properly validate origin boundaries within the QUIC stack - specifically on Android - allowing the protocol to serve or expose response data from one origin to a requesting context from a different origin, violating the browser's same-origin policy. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all Chrome versions prior to 151.0.7922.72; the CVE description explicitly scopes this to the Android platform, suggesting the flaw may be tied to Android-specific QUIC socket handling or network stack integration rather than the shared cross-platform Chromium codebase.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Users and administrators should update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store or Chrome's built-in update mechanism. The stable channel update details are published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control for environments where immediate patching is not possible, disabling or restricting QUIC via enterprise policy (chrome://flags/#enable-quic set to Disabled, or via the QuicAllowed enterprise policy) would eliminate the attack surface for this specific flaw; note that this forces fallback to TCP-based HTTP/2, which may increase latency for QUIC-optimized services. No workaround fully substitutes for the patch.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today