EUVD-2026-40608
GHSA-7m6q-ggf5-rwg4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page requiring active victim visit (UI:R, PR:N); impact is read-only cross-origin data leakage with no integrity or availability consequence (C:H/I:N/A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Side-channel cross-origin data leakage in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows remote attackers to infer sensitive content belonging to other origins by enticing a victim to visit a crafted HTML page. The vulnerability exploits a weakness in the Paint subsystem's rendering pipeline (CWE-1300: Improper Protection of Physical Side Channels), enabling an attacker page to observe rendering state or timing variations and reconstruct protected cross-origin data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS probability is low at 0.21% (11th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
Technical ContextAI
The vulnerability is rooted in Chrome's Paint subsystem - the component responsible for rasterizing and compositing web content to screen within the Blink rendering engine. CWE-1300 (Improper Protection of Physical Side Channels) covers scenarios where an implementation inadvertently exposes information through observable side effects of computation, such as rendering timing differences, pixel state leakage, or compositing order signals. In browser contexts, this class of flaw has historically manifested as pixel-stealing attacks, cross-origin timing oracles, or GPU-level state leakage that allows a page to infer content rendered by a different origin. The affected CPE-level product is Google Chrome desktop, all builds prior to 150.0.7871.47, as confirmed by EUVD-2026-40608. The Chromium security team internally classified severity as Medium, consistent with the constrained, read-only nature of the impact.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability per the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism should apply this automatically on most managed and consumer deployments; administrators should verify fleet compliance via endpoint management tooling. For environments where immediate patching is delayed, consider enforcing cross-origin isolation headers (Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp) on sensitive web applications to reduce the surface available to a leaking attacker page - note this may break third-party integrations that rely on cross-origin resource sharing. Restricting Chrome usage on endpoints that simultaneously access untrusted sites and sensitive intranet resources is an additional compensating measure, though operationally disruptive. These controls do not eliminate the underlying Paint side-channel and do not substitute for patching.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today