EUVD-2026-40575
GHSA-3837-hmfh-32c2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page requiring active user navigation; cross-origin data inference yields high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Side-channel information leakage in WebAuthentication within Google Chrome on iOS (versions prior to 150.0.7871.47) enables a remote attacker to infer cross-origin data by directing a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms network-exploitable impact with high confidentiality loss, constrained by mandatory user interaction and scoped exclusively to the iOS platform. No public exploit identified at time of analysis; EPSS at 0.25% (16th percentile) signals low near-term exploitation probability, and no CISA KEV listing is present.
Technical ContextAI
WebAuthentication (WebAuthn) is a W3C standard API built into browsers that supports strong, phishing-resistant authentication using public key cryptography - it underpins passkeys and hardware security key flows. The vulnerability exists specifically in Chrome's iOS implementation, where a side-channel (timing, observable API behavior, or resource-measurement differences) allows a page from one origin to infer state or data belonging to a different origin, violating the Same-Origin Policy's isolation guarantees. CWE-20 (Improper Input Validation) as the assigned root cause class suggests the side-channel arises from insufficient sanitization or normalization of inputs fed into the WebAuthn processing pipeline, producing measurable behavioral differences an attacker page can exploit. No CPE string was supplied in the input, but the affected product is confirmed as Google Chrome for iOS prior to 150.0.7871.47 per EUVD-2026-40575.
RemediationAI
Update Google Chrome on iOS to version 150.0.7871.47 or later - this is the vendor-released patch per the Google Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users should update via the Apple App Store; Chrome on iOS auto-updates when the device is connected and the app is backgrounded, so most users will receive the fix without manual intervention. As an interim workaround for high-risk environments, administrators can restrict access to untrusted web content or deploy content filtering to block externally-hosted HTML from reaching iOS Chrome instances - this reduces exposure but may disrupt legitimate browsing workflows. Disabling WebAuthn entirely is not a supported Chrome configuration option and would break passkey and FIDO2 authentication flows. No additional compensating controls are documented by the vendor for this specific flaw.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today