Description
Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page. (Chromium security severity: Low)
Published: 2026-05-06
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper MHTML parsing path in Chrome before 148.0.7778.96 allows a browser‑side leak of data from foreign origins. A crafted MHTML file can cause the browser to display data belonging to another domain when a user opens the file and performs UI gestures, enabling an attacker to obtain cross‑origin information. This weakness is cataloged under CWE‑1021, CWE‑346, and CWE‑352, and its CVSS score is 3.1.

Affected Systems

Chrome versions earlier than 148.0.7778.96 on Windows, macOS, and Linux are affected. The update resolves the flaw across all supported desktop operating systems.

Risk and Exploitability

Exploitation requires that a user is tricked into opening a malicious MHTML file that includes certain UI gestures. The EPSS score is under 1%, indicating low likelihood of widespread exploitation. This low‑severity vulnerability is not listed in CISA KEV catalog.

Generated by OpenCVE AI on May 9, 2026 at 04:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 148.0.7778.96 or later.
  • Until the update is available, avoid opening MHTML files from untrusted or suspicious sources and refrain from interacting with any unexpected interface prompts.
  • If possible, disable MHTML handling or block malformed attachments via enterprise policy or browser extensions.

Generated by OpenCVE AI on May 9, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6250-1 chromium security update
History

Sat, 09 May 2026 00:15:00 +0000

Type Values Removed Values Added
Title MHTML Cross-Origin Data Leakage via Crafted Files chromium-browser: Inappropriate implementation in MHTML
Weaknesses CWE-346
References
Metrics threat_severity

None

 threat_severity

Low

Thu, 07 May 2026 17:45:00 +0000

Type Values Removed Values Added
Title MHTML Cross-Origin Data Leakage via Crafted Files

Thu, 07 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Weaknesses CWE-352
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Thu, 07 May 2026 01:15:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leak via Crafted MHTML Page in Google Chrome
Weaknesses CWE-200

Wed, 06 May 2026 22:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1021
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 06 May 2026 22:00:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leak via Crafted MHTML Page in Google Chrome
Weaknesses CWE-200

Wed, 06 May 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 06 May 2026 18:30:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page. (Chromium security severity: Low)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-05-06T21:45:16.343Z

Reserved: 2026-05-05T22:59:37.383Z

Link: CVE-2026-8022

cve-icon Vulnrichment

Updated: 2026-05-06T18:35:35.234Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-06T19:16:53.153

Modified: 2026-05-07T15:15:31.760

Link: CVE-2026-8022

cve-icon Redhat

Severity : Low

Publid Date: 2026-05-05T00:00:00Z

Links: CVE-2026-8022 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-09T05:00:10Z

Weaknesses