EUVD-2026-50841
GHSA-4qjg-8r9v-c734
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page
-
DeliveryVictim navigates to malicious page
-
ExploitVictim performs specific UI gestures
-
ExecutionChrome Passwords fails origin validation
-
ImpactCross-origin credential data exfiltrated to attacker
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 151.0.7922.72 with the built-in Passwords/autofill feature active (default configuration) and at least one saved credential for a target origin stored in the browser. The attacker must additionally convince the user to visit a crafted page and perform 'specific UI gestures' - the precise gesture type is not disclosed in the public advisory or available references. The CVSS vector (AC:H/UI:R) confirms exploitation is neither trivial nor automatable, requiring deliberate social engineering. Exploitation is strictly limited to confidentiality (C:L) with no integrity or availability impact, and scope remains unchanged (S:U), ruling out sandbox escape via this path alone. Authentication is not required on the attacker's side (PR:N), but meaningful exploitation is practically constrained by the required victim interaction and the attacker's need to know or guess what origins have saved credentials worth targeting. |
| Impact | Real-world risk is low. The CVSS base score of 3.1 is driven by high attack complexity (AC:H) and mandatory user interaction (UI:R), neither of which is automatable - a finding SSVC independently corroborates with 'Automatable: no.' EPSS at 0.29% (21st percentile) aligns with the low exploitation probability for vulnerabilities requiring non-trivial social engineering and specific gesture sequences. No active exploitation is recorded in CISA KEV, and SSVC exploitation status is 'none.' The notable discrepancy between the Chromium team's 'High' internal severity and the CVSS 3.1 base score of 3.1 warrants attention: the vendor may be weighting the sensitivity of password-related cross-origin leaks more heavily than the CVSS partial-confidentiality metric captures. Defenders in high-sensitivity environments (e.g., enterprise with password manager credentials for critical systems) should treat this with elevated priority relative to the raw CVSS score alone. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page and socially engineers a target into visiting it while Chrome's password manager contains saved credentials for a victim origin. The attacker then induces the user to perform specific UI interactions - such as triggering autofill prompts or clicking crafted elements - causing the Passwords implementation to leak cross-origin data back to the attacker-controlled page. No public exploit code is known at time of analysis, and the specific gesture sequence required is not disclosed in public references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which resolves this vulnerability per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates automatically for most users; enterprise administrators should verify deployment via policy management tools (e.g., Google Admin Console or Chromium enterprise policies). As a compensating control for environments unable to update immediately, disabling Chrome's built-in password manager via enterprise policy (PasswordManagerEnabled=false) eliminates the vulnerable code path entirely, though this removes autofill functionality and may lead users toward less secure credential storage alternatives - weigh this trade-off before applying.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) identifies the root cause: the Passwords subsystem in Chrome fails to properly enforce same-origin policy boundaries under specific UI-interaction conditions. The affected component is Chrome's built-in password manager and autofill implementation, covering all desktop platform variants as indicated by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The flaw allows a crafted page hosted on one origin to infer or read data - likely credential metadata, autofill signals, or password presence indicators - belonging to a different origin, directly violating the browser's isolation model. The CVSS vector (S:U) confirms no sandbox escape is involved; the impact is bounded to the browser process itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page (AV:N), high complexity from required specific UI gestures (AC:H), no attacker auth needed (PR:N), mandatory victim interaction (UI:R), limited confidentiality-only impact with no scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB