EUVD-2026-50860
GHSA-rcf3-4779-3g67
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered crafted page requires active user visit (UI:R); navigation bypass yields integrity-only impact with no confidentiality, availability, or scope-change effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.
Technical ContextAI
The affected component is Chrome's built-in DevTools - the developer tooling accessible via F12 or right-click inspect - which processes HTML and script input from the active browsing context. CWE-20 (Improper Input Validation) identifies the root cause as a failure to adequately sanitize untrusted data before it influences navigation logic within DevTools. Navigation restrictions in browser contexts include same-origin policy enforcement, sandboxing constraints, and URL filtering; a bypass in this layer could allow a crafted page to redirect frames or windows to otherwise-restricted origins. The unchanged scope (S:U) in the CVSS vector indicates the flaw is contained within the browser's own security boundary rather than escaping the sandbox. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with an upper-exclusive bound of 151.0.7922.72 confirms all prior stable versions across Windows, macOS, and Linux are affected.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-confirmed fix per the stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Updates can be applied via Settings > Help > About Google Chrome or through enterprise deployment tools (Google Admin Console, WSUS-integrated packaging). If immediate patching is not feasible in managed environments, restricting DevTools access via the Chrome enterprise policy DevToolsAvailability=Disabled (set to value 2) eliminates the specific attack surface for this component; note this will block legitimate developer workflows and may affect internal tooling that relies on DevTools APIs. No workaround fully substitutes for the patch, as the crafted HTML page delivery vector does not require DevTools to be explicitly opened by the user in all exploitation scenarios.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today