EUVD-2026-30427
GHSA-rvp4-w35h-5454
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N), requires mandatory specific user gestures (UI:R) and high-complexity conditions (AC:H); confidentiality-only impact scoped to Chrome process memory (C:H/I:N/A:N/S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Memory disclosure in Google Chrome's DataTransfer component prior to version 148.0.7778.168 enables remote attackers to read potentially sensitive data from the browser's process memory by convincing a victim to perform specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. While Chromium's internal security team rated this Critical due to the high-confidentiality impact of process memory exposure, the NVD CVSS score of 5.3 reflects the significant exploitation barriers of high attack complexity and mandatory user interaction. No public exploit code exists, EPSS is 0.03% (8th percentile), and CISA has not added this to the KEV catalog, confirming no confirmed active exploitation at time of analysis.
Technical ContextAI
The DataTransfer API is a browser subsystem that manages data exchange during drag-and-drop operations and clipboard interactions between web content and the host system. CWE-20 (Improper Input Validation) indicates the root cause is a failure to adequately sanitize or bounds-check attacker-controlled input flowing into the DataTransfer handling code, plausibly resulting in an out-of-bounds read or type confusion condition that surfaces adjacent heap or stack memory to JavaScript running in a crafted page. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome builds prior to 148.0.7778.168. Tags referencing Red Hat and SUSE indicate that downstream Linux distributions package Chrome or Chromium-based browsers and will require separate package updates from those vendors.
RemediationAI
The primary fix is upgrading Google Chrome to version 148.0.7778.168 or later, as detailed in the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html. Chrome's auto-update mechanism will apply this for most users, but enterprise-managed deployments should verify rollout through policy controls. Red Hat and SUSE users should apply updated Chromium browser packages through their distribution's package management system once available from those vendors. As a compensating control prior to patching, organizations can restrict or block access to untrusted external web content via proxy or web filtering policies, which reduces exposure to crafted pages at the cost of general browsing capability. Disabling drag-and-drop interactions via Chrome enterprise policy (if operationally tolerable) would reduce the DataTransfer attack surface but would impair legitimate web application functionality.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today