EUVD-2026-40496
GHSA-mfv4-w78f-m8f3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via web page with no auth required; user must visit the page (UI:R); impact is confidentiality-only with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Memory disclosure in Google Chrome for Linux (prior to 150.0.7871.47) allows a remote attacker to read sensitive contents from the browser's process memory by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling subsystem, and is platform-specific - only Linux builds are affected. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-reachable, zero-authentication attack path and high confidentiality impact make patching a near-term priority for Linux desktop environments.
Technical ContextAI
The vulnerability resides in the input handling layer of Chromium on Linux, identified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). 'Inappropriate implementation in Input' typically refers to a logic or bounds error in how the browser processes user or programmatic input events, which - on Linux - can create a condition where uninitialized or stale memory is surfaced to page-controlled JavaScript or included in a response observable by the attacker. The Linux-specific nature suggests dependence on a platform API or IPC mechanism that differs from Windows and macOS Chromium builds. Affected CPE maps to Google Chrome versions below 150.0.7871.47 on Linux. The bug was reported through Google's chrome-cve-admin channel and tracked internally at issues.chromium.org/issues/504600482.
RemediationAI
Upgrade Google Chrome on all Linux systems to version 150.0.7871.47 or later, available via the Chrome Stable Channel update documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will apply this automatically on most managed and consumer installations; administrators should verify update propagation via policy or fleet tooling. Where immediate patching is not feasible, a compensating control is to restrict access to untrusted external web content on affected Linux endpoints - for example, using a web proxy allowlist or browser isolation solution to prevent users from loading arbitrary third-party HTML pages. This reduces the attack surface but does not eliminate it for internally hosted content. No workarounds that address the root cause in the input subsystem have been published. Chromium source-level tracking is available at issues.chromium.org/issues/504600482.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today