EUVD-2026-40799
GHSA-jxww-7x73-47c6
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML page (AV:N); high complexity due to required specific UI gestures (AC:H); no privileges needed but active user interaction required (UI:R); confidentiality impact high as process memory may contain credentials or tokens (C:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Process memory disclosure in Google Chrome Enterprise (versions prior to 150.0.7871.47) enables a remote unauthenticated attacker to leak potentially sensitive contents from the browser's process memory by serving a crafted HTML page that induces the victim into performing specific UI gestures. The underlying flaw is classified as CWE-203 (Observable Discrepancy), indicating a side-channel in Chrome's Enterprise component where behavioral differences during UI interactions expose in-memory data. No public exploit code exists and this vulnerability is absent from CISA KEV; EPSS at 0.22% (12th percentile) and SSVC exploitation status of 'none' collectively confirm this is a low-probability exploitation target at time of analysis.
Technical ContextAI
CWE-203 (Observable Discrepancy) describes a class of side-channel vulnerabilities in which differences in system or application behavior - timing, response size, rendering artifacts, or similar - can be observed by an attacker to infer protected information. Here, the flaw resides specifically in Chrome's Enterprise component, meaning the inappropriate implementation is in enterprise policy enforcement or enterprise-specific browser behavior rather than the general rendering engine. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 150.0.7871.47. The attack surface is the browser's HTML/JavaScript processing pipeline: a crafted page triggers the observable discrepancy when specific UI gestures are performed, causing the browser to leak fragments of its own process memory - which may include credentials, authentication tokens, session data, or content from other open tabs depending on memory layout at the time of exploitation.
RemediationAI
Vendor-released patch: Chrome 150.0.7871.47. Update all Google Chrome installations to version 150.0.7871.47 or later via Google's auto-update mechanism or enterprise deployment tooling; this is the definitive fix per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For enterprise environments where immediate patching is constrained, consider enforcing Chrome Enterprise policies to restrict navigation to untrusted external sites via URL allowlists (URLAllowlist/URLBlocklist policies), which reduces attacker ability to serve the crafted HTML page; note this may limit general-purpose web browsing. Disabling JavaScript via enterprise policy would likely break the side-channel mechanism but renders most web applications non-functional and is not a practical long-term control. No workaround eliminates the underlying implementation flaw - patching to 150.0.7871.47 is the only confirmed remediation.
Same weakness CWE-203 – Observable Discrepancy
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today