Skip to main content

Chrome EUVDEUVD-2026-20682

| CVE-2026-5876 MEDIUM
Improper Protection of Physical Side Channels (CWE-1300)
2026-04-08 Chrome GHSA-9wcm-fcg4-668c
Information Disclosure Google Red Hat Suse Chrome
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
SUSE
MEDIUM
qualitative
Red Hat
7.4 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Patch released
Apr 08, 2026 - 23:32 nvd
Patch available
EUVD ID Assigned
Apr 08, 2026 - 22:01 euvd
EUVD-2026-20682
Analysis Generated
Apr 08, 2026 - 22:01 vuln.today
CVE Published
Apr 08, 2026 - 21:20 nvd
MEDIUM 6.5

DescriptionCVE.org

Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Side-channel information leakage in Google Chrome's Navigation feature prior to version 147.0.7727.55 allows unauthenticated remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability requires user interaction (clicking or navigating to a malicious page) but successfully bypasses same-origin policy protections, exposing sensitive information from different origins. With an EPSS score of 0.03% (10th percentile) indicating very low real-world exploitation probability, this represents a medium-severity information disclosure risk appropriate for routine patching rather than emergency mitigation.

Technical ContextAI

This vulnerability exploits side-channel behavior in Chrome's Navigation API, a web platform feature that manages cross-document navigation and history state. Side-channel attacks infer sensitive information by analyzing indirect signals (timing, cache behavior, or resource metadata) rather than direct data access. CWE-1300 (Information Exposure Through Computational Timing) categorizes timing-based side-channel leaks. The flaw allows attackers to differentiate cross-origin page contents or state without direct API access, violating the same-origin policy assumption. The attack surface is the Navigation API's handling of navigation transitions where timing or observable behavior patterns leak information about target origins not under attacker control.

RemediationAI

Vendor-released patch: Chrome 147.0.7727.55. Users should upgrade to Chrome version 147.0.7727.55 or later through Settings > About > Chrome, which triggers automatic download and installation upon next browser restart. Enterprise administrators managing Chrome via policy should update Chrome deployments to version 147.0.7727.55 or later; consult Google's Chrome Enterprise release notes (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html) for rollout details. No workarounds are available for this Navigation API side-channel; patching is the definitive remediation. Organizations using Chrome in restricted environments should verify patch availability in their deployment channels before scheduling updates.

More in Chrome

View all
CVE-2015-5122 CRITICAL POC
9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
CVE-2016-5198 HIGH POC
8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH POC
8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
CVE-2016-1646 HIGH POC
8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2017-5030 HIGH POC
8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2017-3823 HIGH POC
8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
CVE-2014-8636 HIGH POC
7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2015-5123 CRITICAL
9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-1300 – Improper Protection of Physical Side Channels

View all
CVE-2026-11153 CRITICAL
9.1
CVE-2026-14074 MEDIUM
6.5
CVE-2026-13935 MEDIUM
6.5
CVE-2026-13922 MEDIUM
6.5
CVE-2026-13809 MEDIUM
6.5
CVE-2026-13790 MEDIUM
6.5
CVE-2026-14085 MEDIUM
6.5
CVE-2026-14071 MEDIUM
6.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Package Hub 15 SP6 Fixed
openSUSE Leap 15.6 Fixed
openSUSE Tumbleweed Fixed
SUSE Package Hub 15 SP6 Fixed

Share

EUVD-2026-20682 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy