EUVD-2026-50703
GHSA-xp2r-cfm9-38xv
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page with no privileges needed, but user must visit the page; impact limited to partial cross-origin data disclosure only.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.
Technical ContextAI
The Chromium Autofill component is responsible for populating form fields with stored user data (addresses, credit card numbers, credentials). CWE-346 (Origin Validation Error) indicates the subsystem does not adequately verify that an autofill operation is scoped to the page origin that originally stored or requested the data, permitting a cross-origin page to observe or receive autofill-supplied values it should not have access to. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to the fixed version 151.0.7922.72 across all platforms (Windows, macOS, Linux). This class of flaw is a browser-level same-origin policy bypass rather than a network-layer or OS-level issue, meaning exploitation is entirely contained within the browser rendering engine.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch as documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this patch to most users automatically; administrators managing enterprise Chrome deployments via policy should verify fleet-wide update propagation. As a compensating control where immediate upgrade is not feasible, disabling the Autofill feature (chrome://settings/autofill) eliminates the vulnerable code path entirely, though this removes convenience functionality for users relying on stored form data. Restricting navigation to untrusted external pages via browser policy or web filtering reduces the attack surface, since exploitation requires visiting a crafted HTML page. No side effects are associated with the patch itself.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today