Google Chrome CVE-2026-18019

Exploitation requires the victim to actively navigate to an attacker-controlled page (UI:R in the CVSS vector - passive exploitation without user interaction is not possible). No authentication is required from the attacker's side (PR:N). The vulnerability is limited to Chrome desktop versions prior to 151.0.7922.72; updated browsers are not affected. Side-channel attacks of this class are additionally constrained by browser-level timer-precision mitigations introduced post-Spectre (e.g., reduced resolution of performance.now()), OS-level scheduling noise, and hardware variability - all of which degrade measurement reliability and increase the effort required for successful data extraction. Cross-origin data accessible this way is likely limited to indirectly observable attributes (timing of resource loads, presence or absence of cached resources) rather than raw content, further bounding the leakage. No special configuration or feature flag is required beyond a vulnerable Chrome version and user visit.

CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a network-reachable, unauthenticated flaw requiring only user interaction, but with limited confidentiality impact and no integrity or availability consequence. However, the provided CVSS vector assigns S:U (no scope change), which arguably understates a cross-origin data leakage that by definition crosses security boundaries - this is a mild inconsistency worth noting. EPSS at 0.16% (6th percentile) is exceptionally low, indicating the broader security community does not anticipate near-term exploitation in the wild. SSVC confirms exploitation: none and automatable: no, meaning reliable mass exploitation is not expected. The side-channel mechanism itself introduces practical friction: successful extraction depends on stable timing measurements, which are sensitive to browser-side mitigations (e.g., reduced timer precision post-Spectre), OS scheduling noise, and hardware variability. Overall, this is a genuine vulnerability but a low operational priority except for high-sensitivity environments where any cross-origin information leakage is unacceptable.

An attacker hosts a malicious web page containing crafted HTML and JavaScript that triggers specific media processing behavior in Chrome's Media component. When a victim browses to the page, the attacker's script measures timing or resource-consumption side effects to infer data from cross-origin resources the victim's browser has loaded or cached. No public proof-of-concept code has been identified at time of analysis, and the attack is non-automatable per SSVC assessment.