EUVD-2026-50883
GHSA-58xh-hcfp-r656
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page but requires pre-compromised renderer (AC:H); confidentiality-only, limited-scope impact; no target system authentication required for the leak step (PR:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
Technical ContextAI
CORS (Cross-Origin Resource Sharing) is a browser security mechanism enforcing the Same-Origin Policy by controlling which cross-origin HTTP responses a web page may access. CWE-346 (Origin Validation Error) identifies the root cause: the Chrome CORS subsystem fails to properly validate origin boundaries under specific conditions, allowing cross-origin data that should be blocked to be read by a compromised renderer. The Chrome renderer process is the sandboxed component responsible for parsing HTML, executing JavaScript, and making network requests; when already compromised (via a separate exploit), this CORS flaw provides an additional data exfiltration primitive. Affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions below 151.0.7922.72.
RemediationAI
Upgrade to Google Chrome 151.0.7922.72 or later, which contains the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates for most users, but enterprise administrators managing Chrome via policy should verify the update has deployed across managed endpoints. Because this vulnerability is only exploitable after a renderer process has already been compromised, compensating controls that reduce renderer compromise risk also reduce this attack surface: enabling Chrome's built-in Site Isolation (active by default in modern Chrome), minimizing installed browser extensions to trusted and audited sources, and blocking known malicious web content at the network perimeter. These measures do not substitute for the patch but address the prerequisite attack step.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today