EUVD-2026-50729
GHSA-pv4w-f6r6-3qcw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker server
-
DeliveryDeliver link to victim via phishing or social engineering
-
ExploitVictim opens page in vulnerable Chrome
-
ExecutionTrigger IWA navigation policy bypass
-
PersistAccess restricted IWA navigation targets
-
ImpactExfiltrate or manipulate restricted content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively visit a crafted HTML page (UI:R - user interaction is mandatory, ruling out fully passive or drive-by exploitation). The vulnerability is specific to Chrome's Isolated Web Apps subsystem; it is most impactful in environments where IWAs are deployed and restrict access to sensitive navigation targets. No authentication or special privileges are required from the attacker (PR:N), but the attack is bounded by: (1) the requirement for user interaction to load the malicious page, (2) the partial scope - no full sandbox escape or code execution is implied, and (3) the non-default nature of IWA deployments in most consumer Chrome installations, which limits real-world blast radius despite the broad CPE match. |
| Impact | The CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) correctly reflects a medium-severity, remotely triggered vulnerability requiring one click of user interaction. The partial impacts across confidentiality, integrity, and availability align with a security boundary bypass rather than full code execution. EPSS at 0.22% (13th percentile) is very low, and SSVC confirms exploitation status as 'none,' with the attack deemed non-automatable and technical impact only partial - all three signals agree this is not a high-urgency, mass-exploitation-grade flaw. No CISA KEV listing and no public POC further reduce operational risk. The most credible threat is targeted abuse in scenarios where IWAs are deployed with sensitive restricted endpoints, not broad opportunistic exploitation. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page on an attacker-controlled domain designed to trigger the IWA navigation restriction bypass. A victim using a vulnerable Chrome version is socially engineered into visiting the page, after which the exploit causes Chrome to navigate within an IWA context to a restricted origin or endpoint that should be inaccessible, potentially exposing sensitive IWA-restricted content. No public POC has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Navigation restriction bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to circumvent sandboxing controls by luring a user to a crafted HTML page. Versions prior to 151.0.7922.72 are affected. No public exploit exists and SSVC confirms no active exploitation; with an EPSS of 0.22% at the 13th percentile, this is a medium-priority defect addressed by Chrome's stable-channel update released in July 2026.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Help > About Google Chrome) or via enterprise MDM/GPO deployment; the update is documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations that cannot immediately patch, a practical interim control is to restrict or disable Isolated Web App installations via Chrome enterprise policy (IsolatedWebAppsEnabled set to false) - this eliminates the vulnerable attack surface but also disables IWA functionality for users. No alternative network-level workaround effectively mitigates this class of client-side navigation bypass.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Isolated Web Apps is a Chrome security feature that enforces strict navigation restrictions, origin isolation, and content policies for installable web applications, analogous to a stricter Content Security Policy sandbox. The root cause is classified as CWE-284 (Improper Access Control): the Chrome engine does not correctly enforce navigation policy boundaries within the IWA context, allowing a crafted page to navigate to restricted origins or endpoints that should be inaccessible. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome variants on all platforms prior to the fixed release.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Navigation bypass enables limited cross-origin access supporting C:L and I:L; no mechanism for availability impact is described, so A:N is assessed rather than A:L.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Multiple Security Flaws
View all 80Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB