EUVD-2026-40700
GHSA-9328-xv8p-cpr8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page (AV:N), high complexity for side-channel conditions (AC:H), user interaction required (UI:R); pure confidentiality impact with no integrity or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables a remote attacker to read potentially sensitive data from the browser's process memory by inducing a victim to visit a specially crafted HTML page. The vulnerability is classified under CWE-1300 (Improper Protection of Physical Side Channels), indicating that observable rendering or timing behavior in Chrome's CSS engine can be exploited to infer in-memory state. No public exploit identified at time of analysis; however, the CVSS-assessed confidentiality impact is rated High, and Google has released a fix in Chrome stable channel version 150.0.7871.47.
Technical ContextAI
CWE-1300 covers improper protection of physical or microarchitectural side channels - in this context, CSS processing within the Chrome renderer exposes observable differences (such as timing, paint behavior, or resource loading patterns) that allow cross-boundary inference of process memory content. CSS-based side-channel attacks have a documented history in browser security: historical examples include CSS history sniffing (visited link leakage) and more advanced pixel-perfect timing attacks that abuse CSS property evaluation or compositing pipelines. The affected product is Google Chrome, all versions of the stable channel prior to 150.0.7871.47, as confirmed by the EUVD entry EUVD-2026-40700 and the Chrome Releases advisory. The Chromium issue tracker reference (issues.chromium.org/issues/517110749) indicates the flaw was tracked internally before public disclosure.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later using the browser's built-in update mechanism (Menu → Help → About Google Chrome) or via enterprise deployment tooling (Google Update / WSUS integration). The vendor advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For environments where immediate patching is not feasible, restrict user access to untrusted or external web content via proxy filtering or browser isolation solutions - these reduce exposure by preventing users from reaching attacker-controlled pages that would deliver the crafted HTML. Note that blocking specific CSS features at the network layer is not a practical compensating control given the breadth of legitimate CSS usage; browser isolation (e.g., Remote Browser Isolation platforms) is the only operationally sound workaround if patching is delayed.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today