EUVD-2026-50751
GHSA-c62j-fg2f-q75x
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
GPU side-channel attacks require precise timing control and crafted workloads, warranting AC:H; all other metrics match the NVD assessment.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.
Technical ContextAI
CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause as insufficient isolation of GPU hardware state between rendering contexts belonging to different origins. GPU resources - such as shared caches, execution pipelines, or memory bandwidth - can exhibit measurable timing or resource-contention differences depending on what data they process. An attacker-controlled page can craft GPU workloads that cause observable side-effects when the GPU also processes content from a victim origin, violating the browser's cross-origin isolation guarantees. This class of vulnerability is architecturally related to CPU-side Spectre/Meltdown attacks but targets the graphics subsystem. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the Android-specific GPU driver stack being the relevant attack surface. Chrome's site isolation and renderer sandboxing mitigate many cross-origin attacks, but GPU memory and shader execution paths represent a lower-level channel that these software mitigations do not fully address.
RemediationAI
The primary fix is to update Google Chrome on Android to version 151.0.7922.72 or later, available through the Google Play Store or Chrome's built-in update mechanism; this is a vendor-released patch confirmed by the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As an interim compensating control for environments where immediate update is not possible, restricting access to untrusted or unknown websites on Android devices reduces exposure, though this degrades browser utility. Enabling Chrome's enhanced site isolation settings (chrome://flags/#enable-site-per-process) may reduce cross-origin GPU state sharing on supported Android configurations, but this is not a guaranteed mitigation for GPU-level side channels. There are no known effective network-layer workarounds since the attack is delivered via standard HTML and GPU rendering instructions.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today