EUVD-2026-50800
GHSA-g2wc-g6r3-6429
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page, no attacker privileges needed, active user visit required (UI:R), integrity-only impact as CSP bypass enables unauthorized script execution with no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. No public exploit code has been identified and EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation probability despite Chrome's ubiquitous deployment footprint.
Technical ContextAI
Google Chrome's HTML rendering engine contains a logic flaw (CWE-693: Protection Mechanism Failure) in how it processes certain HTML constructs, causing the browser's Content Security Policy enforcement to be bypassed. CSP is a browser-enforced security layer that restricts sources of executable scripts, styles, and other resources - a bypass undermines this entire defense layer, potentially enabling cross-site scripting or unauthorized resource loading even on sites that have correctly deployed CSP headers. Affected products are identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 151.0.7922.72 across desktop platforms. The ENISA EUVD entry (EUVD-2026-50800) corroborates the affected version range. Note: the 'Authentication Bypass' tag present in the intelligence feed appears to be a misclassification - the described mechanism is a protection-mechanism bypass (CSP), not an authentication bypass, and CWE-693 confirms this.
RemediationAI
The vendor-released patch is Chrome 151.0.7922.72, available via Chrome's built-in auto-update mechanism or through the Chrome menu under Help > About Google Chrome. Users and administrators should verify the installed version reaches at least 151.0.7922.72 by navigating to chrome://settings/help. The full release advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the upstream Chromium issue is tracked at https://issues.chromium.org/issues/513791232. For enterprise environments where immediate patching is constrained, enabling CSP violation reporting endpoints (report-uri or report-to directives) can provide detection coverage, though this does not prevent the bypass itself. Organizations that rely on CSP as a primary XSS mitigation layer should treat this patch with heightened urgency relative to the low EPSS score, since a CSP bypass directly neutralizes that control.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today