EUVD-2026-93740
GHSA-rqcx-v445-wf8c
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a genuinely low-to-moderate priority issue despite being in ubiquitous software. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) yields 4.3 (Medium), reflecting limited confidentiality-only impact (C:L) with no integrity or availability effect, and crucially requires user interaction (UI:R) - the victim must visit an attacker-controlled page. All real-world exploitation signals point low and are mutually consistent: CISA SSVC records Exploitation:none, Automatable:no, Technical Impact:partial; there is no CISA KEV listing and no public exploit identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. One technical caveat: CVSS lists AC:L, but CWE-362 race conditions typically demand precise timing to win the race, which realistically warrants AC:H - Google's own 'Medium' Chromium severity rating aligns with a hard-to-reliably-trigger, low-impact information leak rather than a priority threat. Net assessment: patch via normal update cadence; not an emergency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Cross-origin data leakage in Google Chrome is possible when a victim opens a crafted HTML page that triggers a race condition in the browser's WebAudio implementation; the issue affects all Chrome builds prior to 155.0.8059.39 on every platform covered by the generic CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The impact is confidentiality-only and low severity (CVSS 4.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), requiring the user to interact with attacker-supplied content before any data can be exposed, and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as 'none', automatability as 'no', and technical impact as 'partial'. Google has released a vendor patch in Chrome 155.0.8059.39, so this is best handled as a low-to-moderate priority update rather than an emergency response, as reflected in our assessment that this is a genuinely low-to-moderate priority issue despite being in ubiquitous software.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 155.0.8059.39 or later. On managed fleets, push the updated build through the standard update mechanism (Chrome's built-in updater via chrome://settings/help, or enterprise package channels such as MSI/PKG/APT/RPM or Play Store/MDM distribution) and verify the version string after deployment. Details are in Google's stable channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, with the underlying fix tracked at https://issues.chromium.org/issues/520153320. Because exploitation requires the victim to open a crafted page and results only in low-severity cross-origin data leakage, no emergency mitigation is required; however, if patching must be deferred, the practical compensating controls are restrictive rather than surgical: enforce enterprise URL allow/block policies to reduce exposure to untrusted pages, tighten cross-origin isolation settings, or disable Web Audio features via enterprise policy where the business can tolerate broken media/audio functionality on internal sites. Note the trade-offs - blocking or disabling WebAudio will break legitimate audio and media-heavy web applications, and generic phishing/ad-blocking controls only reduce, not eliminate, the attack surface, since the flaw is triggered by timing rather than by a recognizable payload. Downstream Chromium-based browsers inherit the fix at their own release cadence, so confirm the patched version with each vendor rather than assuming parity with Chrome 155.0.8059.39.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a race condition (CWE-362) in Chrome's Web Audio API implementation. WebAudio decodes and mixes audio on worker/audio threads that share buffers and graph state with the main renderer thread; when synchronization between those paths is insufficient, timing can be influenced so that state or data belonging to one origin is observable from another. This places the bug in the well-known browser side-channel / cross-origin information-leak class, where the attacker does not break the same-origin policy directly but exploits asynchronous processing of media data that can be requested cross-origin without CORS. The CVSS vector confirms the profile: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R) because the victim must load the crafted page, scope unchanged (S:U), and only low confidentiality impact (C:L) with no integrity or availability impact. The generic CPE string does not differentiate platform or channel, so the exposure covers desktop and mobile Chrome distributions that predate the fixed build. Multi-source records align on the fix: the Chrome stable channel advisory (chromereleases.googleblog.com, October 2026 stable update) and the Chromium issue tracker entry 520153320, with EUVD-2026-93740 and the NVD record carrying the same affected-version boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB