EUVD-2026-50889
GHSA-qv2f-7gph-gxx4
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring passive user visit; no privileges needed; only limited confidentiality impact (cross-origin data leak); no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.
Technical ContextAI
The vulnerability resides in Chrome's SVG (Scalable Vector Graphics) rendering engine and is classified as CWE-346 (Origin Validation Error). SVG natively supports cross-origin resource references through elements such as image, use, and filter primitives that can fetch or render content from external origins. When origin boundary enforcement is implemented incorrectly, crafted SVG markup can cause the browser to expose pixel-level or metadata-level information from cross-origin resources back to the embedding page, effectively bypassing the Same-Origin Policy. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, encompassing all Chrome desktop releases on Windows, macOS, and Linux prior to the 151.0.7922.72 stable channel update. The Chromium bug tracker issue 517759257 is referenced but likely restricted, so the precise code path triggering the flaw has not been publicly disclosed.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later as documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism typically applies this silently; users can force an immediate update via chrome://settings/help. Enterprise administrators managing Chrome at scale via Google Admin Console or endpoint management tools (e.g., Intune, JAMF) should push version 151.0.7922.72 to all managed endpoints. No workaround is necessary given confirmed patch availability, but organizations with high-sensitivity environments may temporarily restrict end-user navigation to untrusted external sites via DNS filtering or proxy policy to reduce exposure until patching is confirmed complete.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today