EUVD-2026-40835
GHSA-jqpp-vvpr-c7vw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted webpage (AV:N), no attacker privileges needed (PR:N), but victim must visit the page (UI:R); impact is confidentiality-only within the renderer process (C:H/I:N/A:N/S:U).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.
Technical ContextAI
CWE-843 (Type Confusion) describes a class of flaw where software accesses a resource using an incompatible type, causing the runtime to misinterpret memory layout. In this case, the vulnerability resides in Chrome's CSS subsystem - part of the Blink rendering engine - where a CSS object is incorrectly treated as a different type during processing. This mismatch causes the renderer to read from unintended memory regions, potentially exposing in-process data such as other page content, cached values, or runtime structures. The affected product is Google Chrome across all desktop platforms (Windows, macOS, Linux) in versions prior to 150.0.7871.47. No explicit CPE strings were provided in the source data; the vulnerability maps to cpe:2.3:a:google:chrome with an upper version bound exclusive to 150.0.7871.47.
RemediationAI
The primary fix is to upgrade Google Chrome to version 150.0.7871.47 or later, released via the stable channel update at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this patch automatically for most consumer installations; enterprise administrators should push the update through Google Chrome Enterprise policy or endpoint management tooling and verify version compliance via fleet reporting. If immediate upgrade is not feasible, enforcing Chrome's Site Isolation feature (already enabled by default in modern releases) reduces cross-origin memory leakage risk by isolating renderer processes per origin. Restricting end-user browsing to approved domains via proxy or DNS filtering reduces exposure to attacker-hosted crafted pages, though this carries operational trade-offs for productivity. No workarounds that fully neutralize the underlying type confusion in the CSS engine have been identified from available data.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today