EUVD-2026-40769
GHSA-4gg5-wmvc-48mj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Race condition exploitation requires precise timing alignment beyond attacker control, justifying AC:H; no privileges needed and confidentiality impact is high from cross-origin data leakage.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome's Storage component prior to version 150.0.7871.47 enables remote attackers to read data belonging to a different origin by exploiting a race condition triggered via a crafted HTML page. The Chromium security team internally rated this as Low severity - a notable contrast to the CVSS 6.5 score reflecting High confidentiality impact - suggesting the practical exploitation window or data exposure scope is constrained in real-world conditions. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) confirms negligible observed exploitation activity.
Technical ContextAI
The vulnerability is rooted in CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) within Chrome's Storage subsystem. Browser storage components manage access to shared resources - such as localStorage, sessionStorage, or cache - and must enforce strict synchronization across concurrent threads or asynchronous callbacks. When synchronization primitives are absent or improperly applied, a narrow timing window can allow one origin's execution context to observe storage state belonging to another origin, violating the Same-Origin Policy (SOP). This class of race condition is particularly challenging to eliminate in a high-concurrency browser architecture, where renderer processes handle multiple origins and storage I/O operations occur asynchronously. Affected product per EUVD data: Google Chrome versions prior to 150.0.7871.47 across all desktop platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this race condition per the Chromium stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will typically apply this update without user intervention; administrators managing enterprise Chrome deployments should verify rollout completion via chrome://settings/help or their endpoint management platform. If immediate patching is blocked by change control, a compensating control is to enforce Chrome's Site Isolation feature (--site-per-process, enabled by default in modern Chrome) which limits cross-origin renderer access; however, this does not fully mitigate a race condition within the Storage component itself and is not a substitute for patching. Blocking untrusted external web browsing at the network perimeter reduces exposure surface but is operationally impractical for most organizations.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today