EUVD-2026-50904
GHSA-67c8-vprw-8m9v
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page; AC:H reflects side-channel timing precision required; UI:R for mandatory victim page load; C:H for process memory exposure; no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Technical ContextAI
WebCodecs is a browser-native API that provides low-level, synchronous access to video and audio codec implementations, designed to minimize overhead for media-intensive web applications. CWE-1300 (Improper Protection of Physical Side Channels) covers vulnerabilities where observable microarchitectural behaviors - such as timing differences, cache state, or speculative execution artifacts - leak information across security boundaries. In this case, a crafted HTML page can abuse the WebCodecs processing path to induce measurable side-channel signals that reveal contents of the renderer process memory. The high attack complexity (AC:H) in the CVSS vector reflects that exploiting timing or cache-based side-channels reliably requires carefully controlled conditions, including precise measurement and noise mitigation. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later immediately via the browser's built-in update mechanism or the Chrome release blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For Chromium-based derivative browsers, apply vendor-specific updates that incorporate the same upstream patch. As a compensating control for environments where immediate patching is not feasible, Content Security Policy (CSP) headers can be deployed on sensitive web applications to restrict cross-origin resource loading, reducing attacker ability to construct the precise HTML environment needed for the side-channel. Disabling the WebCodecs API via enterprise policy (if supported by the Chrome management framework) would eliminate the attack surface but may break legitimate media-heavy applications. Standard browser isolation hardening - such as enabling strict site isolation - reduces cross-origin memory leakage risk as a defence-in-depth measure.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today