EUVD-2026-40703
Race Condition (CWE-362)
GHSA-x63f-3c5p-f7p4
6.5
CVSS 3.1 · Vendor: google
Share
Severity by source
Vendor (google)
PRIMARY
6.5
MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today
AI
5.3
MEDIUM
Race condition (CWE-362) requires winning a timing window, warranting AC:H over the vendor-assigned AC:L; all other metrics reflect unauthenticated, user-interaction-required cross-origin disclosure with no integrity or availability impact.
3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Lifecycle Timeline
4
Analysis Generated
Jul 01, 2026 - 15:44 vuln.today
CVSS changed
Jul 01, 2026 - 15:22 NVD
6.5 (MEDIUM)
CVE Published
Jun 30, 2026 - 23:17 cve.org
MEDIUM 6.5
CVE Published
Jun 30, 2026 - 23:17 cve.org
UNKNOWN (no severity yet)
DescriptionCVE.org
Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Attacker hosts crafted WebRTC HTML page
Delivery
Victim lured to page via phishing or malvertising
Exploit
Chrome on Windows initiates WebRTC session
Execution
Race condition fires in unsynchronized WebRTC thread
Persist
Cross-origin data accessed before SOP boundary enforced
Impact
Sensitive cross-origin data exfiltrated to attacker
Access
Attacker hosts crafted WebRTC HTML page
Delivery
Victim lured to page via phishing or malvertising
Exploit
Chrome on Windows initiates WebRTC session
Execution
Race condition fires in unsynchronized WebRTC thread
Persist
Cross-origin data accessed before SOP boundary enforced
Impact
Sensitive cross-origin data exfiltrated to attacker
Vulnerability AssessmentAI
| Exploitation | Victim must be running Google Chrome on Windows - non-Windows Chrome installations are explicitly not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N scores 6.5 and reflects a network-accessible, unauthenticated attack requiring only that a victim visit a malicious page, with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a domain and hosts a crafted HTML page embedding malicious JavaScript that deliberately triggers a race condition in Chrome's WebRTC stack while the page loads. A victim on a Windows machine running unpatched Chrome visits the page - via phishing link, malvertising, or a watering-hole site - and the race condition fires during WebRTC initialization, allowing the attacker's script to read data from a cross-origin context (such as an authenticated session on another tab or embedded frame) before Chrome's Same-Origin Policy boundary is enforced. … |
| Remediation | Update Google Chrome on Windows to version 150.0.7871.47 or later immediately; this is the vendor-released patch confirmed in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).