EUVD-2026-50832
GHSA-5ggp-m8m8-wmgj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; all other metrics align with vendor vector as delivery, impact scope, and user interaction are accurately characterized.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Technical ContextAI
The vulnerability resides in the Media component of Google Chrome on Windows, as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root cause class is CWE-20 (Improper Input Validation): the Media subsystem fails to adequately validate untrusted inputs supplied via crafted HTML, allowing that data to cross origin boundaries that the Same-Origin Policy should enforce. Chromium's multi-process architecture sandboxes renderer processes, but this vulnerability assumes renderer process compromise has already occurred - the Media component's validation gap is then abused to access cross-origin resources the victim's browser has loaded. The Windows-specific scope indicates a platform-dependent code path, likely in Windows-specific media API handling rather than cross-platform Chromium code.
RemediationAI
Upgrade Google Chrome on Windows to version 151.0.7922.72 or later, the patched release confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in update mechanism will deliver this automatically; enterprise administrators should verify deployment via Group Policy (ChromeVersion policy) or their MDM solution and confirm no managed endpoints are pinned to older channel versions. As a compensating control pending patch rollout, restricting user access to untrusted external sites via web proxy allowlists reduces the attacker's HTML delivery surface, though it does not address the underlying flaw. Chrome's Site Isolation feature (enabled by default) provides partial defense-in-depth against cross-origin leakage but is not a substitute for patching given this vulnerability specifically bypasses Media component validation.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today