Why this deserves its current priority

CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Google/Chrome (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Google/Chrome.
2. 2Review the reported fix. Update Google/Chrome to 149.0.7827.197 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jun 24, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jun 26, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jun 24, 2026

Sources and claim methodology

• Source referencechromereleases.googleblog.com
• Source referenceissues.chromium.org

Related CVEs

• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object ReferenceSame generic ecosystem
• Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST APISame generic ecosystem
• User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL InjectionSame generic ecosystem
• WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys ProviderSame generic ecosystem
• miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingSame generic ecosystem
• Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_loginSame generic ecosystem

Why this deserves its current priority

CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Google/Chrome (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Google/Chrome.
2. 2Review the reported fix. Update Google/Chrome to 149.0.7827.197 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jun 24, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jun 26, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jun 24, 2026

Sources and claim methodology

• Source referencechromereleases.googleblog.com
• Source referenceissues.chromium.org

Related CVEs

• Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object ReferenceSame generic ecosystem
• Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST APISame generic ecosystem
• User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL InjectionSame generic ecosystem
• WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys ProviderSame generic ecosystem
• miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingSame generic ecosystem
• Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_loginSame generic ecosystem