EUVD-2026-50713
GHSA-h8ww-33xv-qc27
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page with no attacker privileges; user must visit the page (UI:R); SOP bypass yields integrity-only impact with no data disclosure or availability loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same Origin Policy bypass in Google Chrome's FedCM (Federated Credential Management) subsystem prior to version 151.0.7922.72 enables remote attackers to achieve high-integrity cross-origin impact by luring victims to a crafted HTML page. The flaw stems from an inappropriate implementation in the FedCM API, which fails to enforce origin boundaries correctly (CWE-693). No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability despite the network-accessible attack vector.
Technical ContextAI
FedCM (Federated Credential Management) is a modern browser API introduced to support privacy-preserving federated identity flows without reliance on third-party cookies, allowing identity providers to authenticate users across origins in a structured, browser-mediated manner. The root cause is CWE-693 (Protection Mechanism Failure), where Chrome's FedCM implementation fails to correctly enforce the Same Origin Policy - the foundational browser security boundary separating content from different origins. This allows a crafted HTML page to abuse the FedCM flow to perform cross-origin actions that should be restricted. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all desktop Chrome builds prior to 151.0.7922.72. The Chromium issue tracker reference (issues.chromium.org/issues/511754400) provides the upstream bug context, and the flaw was reported and fixed by the Chrome team.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-confirmed fix version per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism should apply this update automatically on most managed and consumer endpoints; verify update completion via chrome://settings/help. For enterprise environments using managed Chrome deployments, force-push the update through Google Admin Console or MDM policy and verify version compliance before the next scheduled maintenance window. If immediate patching is not feasible, a compensating control is to restrict or disable FedCM via enterprise browser policy (if such a policy toggle is available in the relevant Chrome version), which removes the vulnerable attack surface at the cost of breaking federated sign-in flows that rely on the FedCM API. Chromium-based browsers built on affected upstream versions should be updated to builds incorporating the patch from Chromium issue 511754400.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today