EUVD-2026-40833
GHSA-hvxq-fjww-g5fj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N), no attacker auth needed (PR:N), victim must visit page (UI:R), confidentiality-only impact with no code execution or integrity change (C:H, I:N, A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leak in Google Chrome's CSS implementation (versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive data from other origins when a victim visits a specially crafted HTML page. The vulnerability stems from inappropriate CSS handling that creates a side-channel bypassing same-origin policy protections, resulting in high-confidentiality-impact information disclosure with no integrity or availability consequences. No public exploit has been identified and exploitation has not been observed in the wild; CISA SSVC rates exploitation as none and technical impact as partial, aligning with Google's internal Low severity classification despite the NVD CVSS 6.5 score.
Technical ContextAI
The vulnerability resides in Chromium's CSS rendering engine and is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). CSS-based cross-origin leaks typically arise from browser rendering behaviors - such as timing side-channels via CSS features, paint worklets, selector-based probing, or resource-load status inference - that inadvertently expose information about cross-origin resources in violation of the same-origin policy. The affected component is the CSS subsystem in Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions prior to 150.0.7871.47). The issue was reported by chrome-cve-admin@google.com and tracked as Chromium issue 514550047, which is likely restricted from public view. The EUVD identifier is EUVD-2026-40833.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, as confirmed by Google's stable channel release advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates in most consumer deployments; enterprise administrators using managed Chrome policies should verify the update has propagated via their MDM or endpoint management tooling. As a compensating control in environments where patching is delayed, deploying browser isolation (e.g., remote browser isolation or Chrome's Site Isolation feature) can reduce the impact of cross-origin leaks by segregating origin contexts. Restricting access to untrusted or external web content via proxy filtering can reduce attacker-controlled page delivery, though this carries significant usability trade-offs. Given the low EPSS and SSVC exploitation rating, standard patch cycle remediation is appropriate.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today