EUVD-2026-50766
GHSA-pq35-39hr-58r8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious NEL/Reporting-Endpoints headers
-
DeliveryDeliver page link to target user via phishing or malicious ad
-
ExploitVictim visits page in vulnerable Chrome
-
ExecutionBrowser processes cross-origin reporting data with insufficient origin validation
-
ImpactCross-origin network event data leaked to attacker-controlled reporting endpoint
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | The victim must actively navigate to an attacker-controlled HTML page using Google Chrome prior to version 151.0.7922.72 - user interaction is a hard prerequisite (UI:R). The ReportingAndNEL feature must be active, which is the default configuration in Chrome; no special administrator-enabled mode is required. Exploitation is bounded by: the mandatory user interaction (attacker must deliver and the user must visit the malicious page), the low confidentiality impact class (cross-origin data leakage, not authentication material per available description), SSVC confirmation that the attack is not automatable, and Chrome's sandbox architecture which constrains what cross-origin data is accessible to the reporting pathway. No authentication to any service is required on the attacker side, but the attack is inherently single-target (not mass-automatable) due to the UI:R requirement. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects a network-reachable, low-complexity flaw requiring no attacker privileges but mandating user interaction - a victim must visit a crafted page. The confidentiality impact is explicitly low, with zero integrity or availability consequence. EPSS at 0.17% (7th percentile) strongly corroborates the low near-term exploitation probability. SSVC reinforces this: exploitation is none, the attack is not automatable (user interaction gate), and technical impact is only partial. No CISA KEV listing exists. The net real-world risk is moderate-to-low: the vulnerability is genuine and the disclosure vector is accessible, but the constrained impact (partial cross-origin data, not credentials or full session context) and the browser's existing sandbox further bound the blast radius. This is not a high-priority emergency but should be patched promptly given Chrome's auto-update capability makes remediation trivial. |
| Exploit ScenarioDerived | An attacker registers a reporting endpoint and hosts a crafted HTML page that sets NEL or Reporting-Endpoints headers referencing cross-origin resources, causing a victim's Chrome browser to process and relay cross-origin network event data to the attacker's collector. When a user visits this page in a vulnerable Chrome version, the browser's flawed origin validation allows the attacker to observe limited information about cross-origin requests or responses that should be opaque. No public exploit code has been identified at the time of this analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the corrected ReportingAndNEL implementation per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates on most consumer and managed configurations; verify the installed version via chrome://settings/help. For enterprise environments managed via Google Admin Console or group policy, confirm that Chrome update policies are not blocking the 151.0.7922.72 stable channel push. As a temporary compensating control, enterprise administrators can disable the Network Error Logging feature via the NetworkErrorLoggingEnabled enterprise policy (Chrome policy reference); note this will prevent legitimate NEL-based error reporting for internal web properties and may generate support tickets from monitoring-dependent teams. No workaround fully eliminates the origin validation exposure without disabling the feature.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Reporting API and Network Error Logging (NEL) are browser-native mechanisms that allow origins to designate reporting endpoints for network errors, CSP violations, and browser-generated events. CWE-346 (Origin Validation Error) identifies the root cause: the browser fails to adequately enforce origin boundaries when processing or relaying reporting data, permitting a malicious page to trigger or observe reports tied to cross-origin resources it should not have visibility into. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop versions up to (excluding) 151.0.7922.72. Both the Reporting API and NEL are enabled by default in Chrome and widely used by web properties for monitoring, meaning the vulnerable code path is routinely exercised.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring active user visit (UI:R, PR:N); only limited cross-origin data disclosed (C:L) with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB