EUVD-2026-50788
GHSA-wm9r-82qw-cfp5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page with cross-origin prefetch directives
-
DeliveryVictim lured to page via phishing or malvertising (user interaction)
-
ExploitChrome prefetch initiates requests to target cross-origin resources
-
ExecutionPolicy enforcement boundary bypassed in prefetch subsystem
-
PersistCross-origin response content inferred or read by attacker page
-
ImpactSensitive cross-origin data exfiltrated to attacker infrastructure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires two concrete conditions: first, the victim must be running Google Chrome in any version prior to 151.0.7922.72 on a desktop platform; second, the victim must actively visit an attacker-controlled HTML page that specifically instructs Chrome to prefetch cross-origin resources - delivery vectors include phishing links, malicious advertisements, or compromised third-party websites. User interaction is mandatory (UI:R per the CVSS vector): the attack cannot succeed without the victim navigating to or opening the attacker's page. The impact is confined to confidentiality leakage of cross-origin data (C:L); the attacker cannot modify resources or cause service disruption. No authentication to the target system, no special Chrome configuration, and no non-default browser settings are required by the attacker, but the value of the leaked data depends entirely on the victim having active authenticated sessions on other origins at the time of the attack. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) accurately reflects the bounded nature of this vulnerability: network-reachable (AV:N) with low attack complexity (AC:L) and no privileges required (PR:N) but mandating active user interaction (UI:R), with impact limited exclusively to partial confidentiality loss (C:L) and no integrity or availability dimension. EPSS at 0.29% in the 21st percentile signals low near-term exploitation probability, consistent with the absence of both public exploit code and a CISA KEV listing. The combination of required user interaction, confidentiality-only impact, and low EPSS places this firmly in a lower operational priority tier despite Chrome's ubiquitous deployment footprint. The primary risk amplifier is scale: a broadly targeted phishing campaign or malvertising operation could expose the cross-origin data of millions of users even at low per-target exploitation rates. No conflicting signals are present in the available data - CVSS vector, EPSS, and KEV absence all point to a moderate, non-critical priority. |
| Exploit ScenarioDerived | An attacker registers a domain and hosts a crafted HTML page that uses Chrome's prefetch API to initiate speculative requests targeting cross-origin resources - for example, a banking portal or webmail page the victim is authenticated to. The victim is directed to the malicious page via a phishing email or malicious advertisement, and Chrome's insufficient policy enforcement allows the attacker's page to read or infer the prefetched cross-origin content, leaking session-specific data back to the attacker's server. No public exploit code is available at the time of analysis, and exploitation at scale would require a reliable delivery mechanism to reach meaningful victim populations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.
RemediationAI
The primary and definitive fix is to update Google Chrome to version 151.0.7922.72 or later via Chrome's built-in silent updater or by deploying the updated installer through enterprise software management tooling; the vendor advisory is available at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. In managed environments where immediate patching is infeasible, administrators can deploy the Chrome enterprise policy PrefetchEnabled=false (or NetworkPredictionOptions set to 2) to disable prefetch entirely - this eliminates the vulnerable code path at the cost of reduced speculative navigation performance and higher perceived page load latency. Restricting employee browsing to allowlisted domains via a web proxy further reduces attack surface by limiting attacker-controlled page delivery. Generic 'defence in depth' measures such as Safe Browsing do not mitigate the underlying origin enforcement flaw and should not be treated as substitutes for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Prefetch feature, a browser performance optimisation that speculatively fetches resources anticipated to be needed during future navigations. CWE-346 (Origin Validation Error) identifies the root cause class: the prefetch subsystem fails to enforce same-origin policy or equivalent Cross-Origin Resource Policy (CORP) controls consistently, allowing policy-violating cross-origin reads to be triggered and their results inferred by the initiating page. The affected product is Google Chrome across all versions prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). The specific Chromium issue is tracked at https://issues.chromium.org/issues/497491557, though the details may be access-restricted pending broader patch adoption. This class of browser-side origin enforcement failures can expose session-dependent resources, authentication tokens embedded in pages, or personalised content served by cross-origin sites the victim is concurrently authenticated to.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring active user visit (UI:R); impact is cross-origin data leakage only (C:L), no integrity or availability effect, no scope change.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB