EUVD-2026-28137Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page (AV:N), high complexity for reliable side-channel measurement (AC:H), mandatory victim visit (UI:R), limited cross-origin read-only leakage with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Side-channel information leakage in the Media component of Google Chrome prior to 148.0.7778.96 enables remote attackers to read partial cross-origin data by enticing a user to visit a specially crafted HTML page. The flaw exploits measurable timing or resource-usage signals during media processing, violating browser Same-Origin Policy isolation at the side-channel level rather than through direct memory access. No public exploit code exists and EPSS exploitation probability is 0.03%, placing this firmly in low real-world priority - though it remains relevant for environments handling sensitive cross-origin data such as financial portals or SSO flows.
Technical ContextAI
CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause as inadequate isolation of observable timing or resource-consumption signals during internal processing. In Chrome's Media subsystem, media-decode or media-fetch operations produce measurable side effects - such as timing differences - that an attacker-controlled page can observe and use to infer information about cross-origin resources the victim's browser is simultaneously processing. This undermines the Same-Origin Policy's intent without requiring a direct memory read. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD-2026-28137 confirm all Chrome desktop versions in the range prior to 148.0.7778.96 carry this flaw. The attack is network-delivered via HTML, consistent with AV:N in the CVSS vector.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.96 or later, the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism handles this silently in most consumer and managed environments; fleet administrators should confirm rollout completion via endpoint management tooling. No documented workaround exists specifically for this Media side-channel. In high-sensitivity environments where immediate patching is not feasible, restricting Chrome's access to untrusted external content via enterprise policy (e.g., URL blocklisting) or enforcing Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers on owned origins can reduce cross-origin leakage surface, though these controls impose usability trade-offs and do not remediate the underlying flaw.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today