EUVD-2026-50846
GHSA-j795-4rhg-3gv3
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; C:L only as cross-origin data disclosure is partial; no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Technical ContextAI
CWE-346 (Origin Validation Error) describes a failure to correctly verify that a resource or action originates from an expected, trusted source. In Chrome's multi-process architecture, the renderer process handles web content and is deliberately sandboxed. The Passwords component is responsible for autofill and credential management; it enforces same-origin checks before providing stored credentials to page contexts. When the renderer is compromised (e.g., via a prior memory corruption exploit in Blink/V8), an attacker-controlled renderer can issue crafted requests to the Passwords subsystem that bypass its origin validation, allowing credentials belonging to one origin to be observed by another. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop builds below 151.0.7922.72. This vulnerability is a second-stage issue - it is a sandbox-escape primitive targeting a specific browser subsystem rather than a standalone entry point.
RemediationAI
The primary remediation is upgrading Google Chrome to version 151.0.7922.72 or later, which includes the vendor-released patch. Users can update via Chrome menu → Help → About Google Chrome or through enterprise management tools. The vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html should be referenced for release notes. Because exploitation requires a prior renderer compromise as a prerequisite, organizations that cannot immediately deploy the patch should prioritize patching any other open renderer-level Chrome vulnerabilities first, as this flaw is only reachable once the renderer sandbox is already breached. Enabling Chrome's Enhanced Safe Browsing and sandboxing hardening policies via enterprise GPO reduces the attack surface for the renderer-compromise precondition. Chromium-based browser vendors should verify and apply the upstream fix from https://issues.chromium.org/issues/522545249.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today