EUVD-2026-50822
GHSA-m2jq-wwj8-85cc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to attacker-controlled web page
-
DeliveryEmbed crafted media referencing target cross-origin resource
-
ExploitChrome Media component processes resource and emits side-channel signal
-
ExecutionAttacker JavaScript measures timing or state observable
-
ImpactInfer cross-origin data from signal pattern
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control bypass
|
| Exploitation Conditions | Exploitation requires a victim user running a vulnerable version of Google Chrome (prior to 151.0.7922.72) to visit an attacker-controlled HTML page containing crafted media content (UI:R). No attacker-side authentication or special privileges are required (PR:N). The victim's browser must process media resources from the crafted page, and the attacker must be able to measure the resulting side-channel signal, which may require a persistent connection or repeated timed requests. Exploitation is limited to cross-origin confidentiality leakage only - there is no integrity or availability impact. The browser sandbox boundary (S:U) constrains the attack to data accessible within the browser context, preventing direct host-level code execution or file system access. Exploitation does not require any non-default Chrome configuration. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) reflects a moderate, remotely exploitable flaw with low attack complexity and no attacker-side authentication requirement, but bounded by a requirement for user interaction and limited to low confidentiality impact with no integrity or availability loss. EPSS of 0.29% (21st percentile) indicates low exploitation probability, consistent with the absence of a CISA KEV listing and no identified public exploit code. The scope is unchanged (S:U), meaning the browser sandbox limits the blast radius and prevents direct host escalation. Real-world risk is moderate rather than critical: exploitation is feasible for motivated actors given AC:L and PR:N, but the attacker must successfully lure a victim to a controlled page, the impact is limited to partial data leakage, and Chrome's automatic update mechanism substantially reduces the vulnerable population quickly after patch release. No signals conflict with the CVSS assessment; all available intelligence is internally consistent. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that embeds or references media resources from a victim's authenticated origin - for example, a private image or audio file accessible only when the victim is logged in to a target service. When the victim visits the attacker's page, Chrome's Media component leaks observable side-channel signals (such as load timing differentials) that the attacker's JavaScript measures to infer the content or state of the cross-origin resource. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) makes this class of timing-based side-channel attack reproducible for a skilled attacker without requiring a logic bug or memory corruption primitive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch; details are published in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism will deliver this patch to most users without manual action, but enterprise environments managing Chrome via policy should verify deployment through their endpoint management tooling. As a compensating control prior to patching, organizations can reduce exposure by enforcing web filtering to block access to untrusted or unknown HTML pages, which limits the attack surface but will impact user access to unreviewed sites. Chrome's strict site isolation (--site-per-process, enabled by default in recent versions) provides additional cross-origin boundary hardening but does not fully remediate this specific side-channel flaw. No workaround fully substitutes for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in Google Chrome's Media subsystem, covering all versions prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause class: a measurable, observable difference - such as resource load timing, cache state, or processing latency - in how the Media component handles cross-origin content. Side-channel attacks of this class exploit the fact that the browser's media pipeline leaves detectable traces accessible to JavaScript on the attacking page, even when direct cross-origin reads are blocked by the Same-Origin Policy. The flaw is contained within the browser sandbox scope (S:U), meaning it does not inherently enable host-level compromise, but it can be leveraged to infer protected data from other origins, such as authenticated session content or private API responses embedded in media.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L), no attacker auth needed (PR:N), victim must visit page (UI:R), impact limited to partial cross-origin data leakage (C:L), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB