What is the CVSS score of CVE-2026-18019?

CVE-2026-18019 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18019?

Yes, a patch is available for CVE-2026-18019. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-18019

EUVD-2026-50945 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-07-30 Chrome

GHSA-ffj5-xf9v-mmp9

Google Information Disclosure

Medium

Disputed · 4.3 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.4 LOW

Side-channel measurement requires stable, low-noise conditions (AC:H); cross-origin data leakage constitutes a security scope boundary crossing (S:C), not S:U as provided.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

4.3 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:39 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 4.3

DescriptionCVE.org

Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.

Technical ContextAI

The vulnerability resides in Chrome's Media subsystem, which handles audio and video decoding, rendering, and resource management. CWE-1300 (Improper Protection of Physical Side Channels) covers implementations that expose measurable observable effects - such as timing, cache state, or resource consumption - that can be used to infer protected data. In browser contexts, this class of flaw typically manifests as a timing or resource-load side-channel where an attacker's script can measure differences in how the media component processes cross-origin resources, extracting information that the same-origin policy is meant to isolate. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome desktop variants are affected prior to the fixed release. The Chromium security team rated this Low severity internally, consistent with the limited scope of leakable data.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later using Chrome's built-in updater (Settings → About Google Chrome) or by downloading directly from the official release page referenced in the advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators should push the update via policy management tools and verify deployment using Chrome's version reporting. No documented workarounds exist for this specific side-channel. As a compensating control for environments unable to update immediately, restricting access to untrusted external web content via web proxy filtering or browser isolation technology can reduce exposure, though these controls introduce browsing friction. Disabling JavaScript execution entirely would prevent the attacker-side measurement script from running, but this is operationally impractical for most organizations. Patch: Vendor-released patch: 151.0.7922.72.