EUVD-2026-50903
GHSA-v3f8-m2r3-c63v
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring victim navigation (UI:R); no attacker auth; impact limited to partial cross-origin data disclosure with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.
Technical ContextAI
The vulnerability resides in Google Chrome's CSS engine and is classified as CWE-346 (Origin Validation Error), meaning Chrome fails to correctly validate or enforce origin boundaries when processing certain CSS constructs. This could involve CSS @import rules, cross-origin stylesheet references, CSS custom properties, or browser-internal CSS APIs that inadvertently expose data restricted to other origins. The same-origin policy (SOP) is the core security boundary being bypassed - CSS is used as the side-channel or bypass vector rather than JavaScript. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions across all platforms (Windows, macOS, Linux, Android, ChromeOS) prior to 151.0.7922.72. The precise internal CSS mechanism exploited is not publicly disclosed; the Chromium issue tracker entry (https://issues.chromium.org/issues/519603552) is likely restricted per Chrome's security disclosure policy.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism typically delivers stable channel patches to end users within 24-72 hours; administrators can verify deployment via chrome://settings/help or enterprise policy reporting. For organizations that cannot immediately update, compensating controls include restricting navigation to untrusted external sites via managed browser policies (Chrome Enterprise's URLBlocklist), enforcing strict Content Security Policy headers on internal applications to limit cross-origin exposure, and using network-level web filtering to block access to known malicious domains. These controls reduce attack surface but do not eliminate the underlying CSS policy bypass and carry trade-offs in user browsing flexibility. Given the low EPSS and absence of active exploitation, these compensating measures are adequate during a standard patch window.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today