EUVD-2026-50792
GHSA-cqjx-gwfh-qhm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain on-path network position (rogue AP/router)
-
DeliveryIntercept Chrome protected traffic
-
ExploitSend malicious traffic exploiting missing crypto step
-
ExecutionBypass discretionary access control
-
ImpactRead or tamper protected data
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires the attacker to hold a privileged (on-path / adversary-in-the-middle) network position relative to the victim's Chrome traffic - e.g. control of a router, gateway, rogue Wi-Fi AP, or the ability to inject/modify traffic on the local segment - from which malicious network traffic is sent to trigger the cryptographic weakness and bypass discretionary access control. No authentication and no user interaction are needed (CVSS PR:N/UI:N), and default Chrome configurations before 151.0.7922.72 are affected. The principal limiting factor is precisely that privileged network position: a purely remote off-path attacker cannot exploit this, which is why the real-world barrier is higher than the AV:N/AC:L vector alone suggests. |
| Impact | Signals are mixed and should be read together. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N, score 9.1) portrays an easy, unauthenticated network attack, but the description qualifies it heavily: exploitation requires 'an attacker in a privileged network position' (on-path/AITM), which realistically raises attack complexity - the AC:L rating appears optimistic and is worth verifying with the vendor. EPSS is low (0.19%, 10th percentile) and there is no KEV listing and no known POC, so mass exploitation is unlikely today; however SSVC flags Automatable:yes and Technical Impact:total, meaning that if a working technique emerges it could be scripted broadly. Net: given Chrome's ubiquity and high confidentiality/integrity impact, this warrants prompt patching, but the on-path prerequisite makes it a targeted rather than opportunistic threat, so it is a priority-to-patch item rather than an emergency drop-everything issue. |
| Exploit ScenarioDerived | An attacker who controls a segment of the victim's network path - for example a rogue access point, a compromised router, or an ARP-spoofing foothold on a shared LAN - intercepts Chrome's protected traffic and exploits the missing cryptographic step to bypass discretionary access control, reading or altering data the control was meant to protect. No user interaction or credentials are required beyond the attacker's network position. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Discretionary access control bypass in Google Chrome desktop before 151.0.7922.72 lets an adversary in a privileged network position defeat a cryptographic protection and manipulate protected traffic. The flaw stems from a cryptographic weakness (CWE-325) rather than a memory-safety bug, and Google rates the Chromium severity High. No public exploit has been identified, EPSS is low (0.19%), and it is not on CISA KEV, but SSVC scores Technical Impact as total and Automatable as yes.
RemediationAI
Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome to 151.0.7922.72 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and use enterprise policies (Chrome Enterprise/managed update servers) to force the rollout across fleets. Verify the running version via chrome://settings/help and confirm against the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Until patching completes, reduce exposure to the on-path prerequisite by restricting use to trusted networks, enforcing VPN/TLS for sensitive traffic, and avoiding untrusted Wi-Fi; these controls lower the chance an attacker can occupy the required privileged network position but do not remove the underlying flaw, so patching remains the only complete fix. Chromium-derived browsers should be updated to a build incorporating the same fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Chromium/Google Chrome browser engine (CPE cpe:2.3:a:google:chrome), specifically an enterprise-facing cryptographic control used to enforce discretionary access control over network communications. CWE-325 (Missing Required Cryptographic Step) indicates that a step in a cryptographic protocol or verification routine was omitted or implemented incompletely, which weakens the guarantee the crypto was meant to provide. Because the weakness lives in how Chrome validates or protects network traffic, an attacker who can observe or modify traffic (a privileged/on-path network position) can leverage the missing step to bypass the intended access-control decision rather than needing to break the underlying cipher.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Requires an attacker-in-the-middle privileged network position, so AC:H rather than the vendor's AC:L; no auth or interaction needed (PR:N/UI:N); high confidentiality and integrity impact but no availability effect (A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)
Executive ViewAI
Google Chrome versions before 151.0.7922.72 contain a critical vulnerability (CVE-2026-17666) that allows network-positioned adversaries to defeat cryptographic protections and manipulate browser traffic. No active attacks have been observed, but the technical impact severity and cross-organizational Chrome prevalence require rapid patching to prevent future exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-325 – Missing Cryptographic Step
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB