EUVD-2026-50732
GHSA-f3vf-jjj8-pj64
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible cross-origin leak requiring no auth but mandatory user page visit; impact limited to partial confidentiality with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.
Technical ContextAI
The vulnerability resides in Chrome's Loader - the browser subsystem responsible for fetching and processing web resources including scripts, stylesheets, and documents. CWE-346 (Origin Validation Error) indicates that the Loader fails to correctly enforce Same-Origin Policy (SOP) or related cross-origin isolation checks when processing attacker-controlled HTML, allowing one origin to observe data that should be opaque from another. This class of flaw directly undermines the browser security boundary that separates web origins. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop variants on all platforms prior to 151.0.7922.72. The Chromium team rated this Medium severity, consistent with limited-scope confidentiality impact and the required user-interaction prerequisite.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism handles this for most desktop users without manual intervention; enterprise administrators should verify fleet-wide update compliance using Chrome Browser Cloud Management or equivalent policy tooling. No vendor-documented workaround exists for this specific flaw. As a compensating control where patching is delayed, organizations operating sensitive web applications can enforce strict Content-Security-Policy and Cross-Origin-Resource-Policy headers on their services to reduce the data surface exposed if a user encounters a malicious page - note this mitigates the impact on the server side but does not eliminate the browser vulnerability itself.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today