EUVD-2026-50766
GHSA-pq35-39hr-58r8
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring active user visit (UI:R, PR:N); only limited cross-origin data disclosed (C:L) with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.
Technical ContextAI
The Reporting API and Network Error Logging (NEL) are browser-native mechanisms that allow origins to designate reporting endpoints for network errors, CSP violations, and browser-generated events. CWE-346 (Origin Validation Error) identifies the root cause: the browser fails to adequately enforce origin boundaries when processing or relaying reporting data, permitting a malicious page to trigger or observe reports tied to cross-origin resources it should not have visibility into. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop versions up to (excluding) 151.0.7922.72. Both the Reporting API and NEL are enabled by default in Chrome and widely used by web properties for monitoring, meaning the vulnerable code path is routinely exercised.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the corrected ReportingAndNEL implementation per the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates on most consumer and managed configurations; verify the installed version via chrome://settings/help. For enterprise environments managed via Google Admin Console or group policy, confirm that Chrome update policies are not blocking the 151.0.7922.72 stable channel push. As a temporary compensating control, enterprise administrators can disable the Network Error Logging feature via the NetworkErrorLoggingEnabled enterprise policy (Chrome policy reference); note this will prevent legitimate NEL-based error reporting for internal web properties and may generate support tickets from monitoring-dependent teams. No workaround fully eliminates the origin validation exposure without disabling the feature.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today