EUVD-2026-50868
GHSA-76gx-p6g2-5x6c
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
S:C reflects cross-origin scope violation; AC:H reflects inherent measurement complexity of side-channel exploitation in practice.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Technical ContextAI
The vulnerability exists within Google Chrome's SVG (Scalable Vector Graphics) processing pipeline, affecting all desktop Chrome releases identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to version 151.0.7922.72. CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause class: the browser exposes a measurable physical or computational signal - most commonly timing differentials, cache access patterns, or resource consumption variance - during SVG rendering that can be correlated by attacker-controlled JavaScript to reconstruct data from a cross-origin context. This class of attack bypasses logical access controls (same-origin policy) by exploiting observable differences in the system's behavior rather than directly reading protected memory, making it inherently difficult to fully prevent through traditional input validation.
RemediationAI
The primary remediation is upgrading Google Chrome to version 151.0.7922.72 or later, as documented in the Chrome stable channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's built-in auto-update mechanism will deliver this patch automatically to most consumer deployments; enterprise administrators managing Chrome via Group Policy or enterprise management platforms should push the update through those channels immediately. As a compensating control while patch deployment is in progress, high-security environments may enforce strict Cross-Origin Resource Policy (CORP) and Cross-Origin-Opener-Policy (COOP) headers on sensitive applications to reduce the data surface exposed to cross-origin probing - however, this does not eliminate the underlying side channel and may introduce compatibility trade-offs with legitimate cross-origin integrations. Disabling SVG rendering is not a standard Chrome enterprise control and would cause widespread application breakage.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today