Monthly
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.
Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.
Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.
Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.
Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.