EUVD-2026-50773
GHSA-mr3q-6x9r-3w9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim clicks phishing or malvertising link
-
ExploitChrome loads page and registers malicious ServiceWorker
-
ExecutionServiceWorker exploits insufficient policy enforcement
-
PersistSame-origin policy bypassed
-
ImpactAttacker manipulates cross-origin browser resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim use a vulnerable version of Google Chrome (prior to 151.0.7922.72) and actively navigate to or be redirected to an attacker-controlled HTML page - mandatory user interaction (UI:R per CVSS). The ServiceWorker API must be available and not blocked by enterprise policy, which is the default state in standard Chrome installations. No authentication of the attacker is required, and no special server-side configuration is needed beyond hosting the crafted HTML. Exploitation is bounded by the requirement for victim interaction: automated network scanning cannot trigger this vulnerability without a human visiting the page. Browsers other than Chrome with independent ServiceWorker implementations are not affected by this specific CVE. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 Medium. Key signals: attack is network-delivered with low complexity and requires no attacker privileges, but mandates victim interaction (UI:R) - limiting automated, mass exploitation potential. The high integrity impact (I:H) with unchanged scope (S:U) and no confidentiality or availability impact bounds damage to within-browser cross-origin manipulation. EPSS at 0.19% (9th percentile) strongly corroborates a low current exploitation probability, and the absence of a CISA KEV listing means active in-the-wild abuse is not confirmed. No public proof-of-concept is identified in the provided data. The mandatory user interaction is the primary real-world risk limiter - exploitation requires social engineering or malvertising delivery. Despite Chrome's ubiquitous deployment, this is a medium-priority patch (not emergency), appropriate for standard monthly patching cycles unless threat intelligence indicates emerging exploitation. |
| Exploit ScenarioDerived | An attacker sends a phishing email containing a link to a crafted HTML page hosted on an attacker-controlled server. When the victim clicks the link and loads the page in a vulnerable Chrome instance, a malicious ServiceWorker is registered that exploits the insufficient policy enforcement to bypass same-origin policy restrictions, allowing the attacker to interact with or manipulate resources from a different origin within the victim's active browsing session. No public proof-of-concept has been identified in the available data, but the low attack complexity (AC:L) suggests the technique does not require advanced tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
ServiceWorker policy enforcement in Google Chrome prior to 151.0.7922.72 is insufficiently enforced, enabling a remote attacker to bypass the browser's same-origin policy (SOP) by delivering a crafted HTML page to a victim. Classified under CWE-284 (Improper Access Control), the flaw carries high integrity impact - cross-origin resource manipulation without data exfiltration - and is exploitable with no attacker privileges, though user interaction is mandatory. EPSS stands at 0.19% (9th percentile) with no CISA KEV listing, placing active exploitation as unconfirmed; however, the low attack complexity and ubiquitous deployment of Chrome make it a realistic target in browser-based phishing campaigns.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, as confirmed by the vendor stable-channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; enterprise administrators should verify deployment via fleet management tools or the chrome://policy endpoint. If immediate updating is blocked by change-control processes, a compensating control is to disable ServiceWorker functionality through Chrome enterprise policy (ServiceWorkerEnabled=false), though this breaks PWA support and offline caching for all sites - a meaningful functional trade-off. Restricting navigation to untrusted or unsolicited URLs via web proxy or Safe Browsing enforcement also reduces exposure, given that user interaction with a crafted page is required for exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ServiceWorker is a browser-native background script API that intercepts and controls network requests, enabling offline caching, push notifications, and Progressive Web App (PWA) functionality. In Chrome's implementation prior to 151.0.7922.72, policy controls governing ServiceWorker cross-origin behavior were insufficiently enforced (CWE-284: Improper Access Control), allowing a malicious ServiceWorker registered from a crafted page to circumvent the same-origin policy - the foundational browser boundary that isolates resources between different web origins. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds before the patched release. The Chromium bug tracker reference (https://issues.chromium.org/issues/517655343) likely contains technical specifics but is expected to be access-restricted until broader patch uptake is achieved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered browser flaw needing no attacker privileges; victim must visit crafted page (UI:R); SOP bypass yields integrity impact with no data disclosure or service disruption.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB