EUVD-2026-50656
GHSA-4mr6-m6p5-pv62
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible via crafted page with no authentication, mandatory user interaction, limited cross-origin data leakage only, and no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Technical ContextAI
The vulnerability resides in Chrome's Network subsystem, affecting all builds covered by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to 151.0.7922.72. CWE-1300 (Improper Protection of Physical Side Channels) describes weaknesses where observable physical or logical side effects of operations - such as timing differences, cache behavior, or resource consumption patterns - reveal information that security boundaries are meant to isolate. In a browser context, this means the Network layer's handling of cross-origin requests produces measurable behavioral differences (e.g., response timing, connection reuse patterns, or error distinguishability) that a malicious page can observe and use to infer facts about resources it should not be able to read directly, circumventing the intent of the Same-Origin Policy without breaching it directly. The Chromium issue tracker reference (issues.chromium.org/issues/497837927) is likely restricted and does not provide further public technical detail.
RemediationAI
The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later, as confirmed by the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism will deliver this to most end users automatically; enterprise administrators managing Chrome via policy should expedite distribution of the 151.0.7922.72 stable channel package through their software management infrastructure. If immediate patching is operationally blocked, compensating controls include ensuring Chrome's Site Isolation feature remains enabled (it is on by default and should not be disabled via enterprise policy) to limit the cross-origin surface observable to malicious pages, and deploying web content filtering to restrict browsing to untrusted or arbitrary sites - though both carry usability trade-offs and neither fully mitigates the underlying side-channel. No workaround short of upgrading fully closes the vulnerability.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today