CVE-2026-18000
Google Chrome ≤ 151.0.7922.72
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-18000 is a low-severity Origin Validation Error (CWE-346) vulnerability in Google Chrome. Its CVSS base score is 3.1 (Low).
Operationally, ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-50926
Vulnerability Data
Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement directly requires validating the source of data before allowing transmission or receipt.
Device identification and authentication mandates verifying the source before establishing connections.
Session authenticity mechanisms require validation that communications originate from the expected party.
Boundary protection at interfaces enforces checks on the origin of incoming communications.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Network security controls enforce origin validation at network boundaries.
Security of network services includes validating the authenticity of service endpoints.
A.8.26 requires identifying and specifying requirements for resilience against malicious attacks including SQL injections and input validation (items d, j), plus related protections (authentication, segregation, cryptography per 8.24), which can address some but not most origin validation scenarios such as those involving untrusted cross-origin requests or implicit trust in sources.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, zero-trust verification) plus design reviews that can catch and block origin-validation gaps in many common cases, but leaves a bounded remainder (e.g. protocol-level or third-party component origin errors not surfaced by the organization's review process).
Secure coding practices include implementing proper origin validation to prevent spoofing.
Secure authentication verifies identity but does not address origin validation of arbitrary data flows.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-346, a class-level weakness, and none of its children carries one either.