EUVD-2026-28061Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page, no privileges needed, mandatory user interaction, only partial cross-origin confidentiality disclosure, no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Media subsystem prior to version 148.0.7778.96 can be exploited by a remote attacker through a specially crafted HTML page, causing partial disclosure of sensitive content from another origin. The flaw is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Media component fails to properly enforce the Same-Origin Policy during media processing. No active exploitation is confirmed in CISA KEV, and EPSS places this at 0.02% (6th percentile), indicating low real-world exploitation probability; patch availability from the vendor makes this a routine patch-cycle priority rather than an emergency.
Technical ContextAI
The vulnerability exists in the Media subsystem of Google Chrome and is classified as CWE-346 (Origin Validation Error). This root cause class indicates that the component fails to adequately validate or enforce the origin of a resource during media operations, allowing an attacker's page to infer or extract data belonging to a different origin - a violation of the browser's fundamental Same-Origin Policy (SOP). Cross-origin leakage via media channels can arise from timing side-channels, media element load events, or error state differentials that reveal information about whether a cross-origin resource exists or partially exposes its content. Affected product is confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 148.0.7778.96. The EUVD entry EUVD-2026-28061 corroborates the affected version range. Tags indicate Red Hat and SUSE have also flagged this, suggesting downstream Chromium packages in those distributions are within scope.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 148.0.7778.96 or later, which resolves this vulnerability per the official vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deliver this patch to most users automatically; the applied version can be verified under Help > About Google Chrome. For Red Hat and SUSE environments deploying packaged Chromium, administrators should monitor vendor-specific security errata for updated Chromium builds incorporating this fix. As a compensating control prior to patching - for environments where browser updates are managed centrally - deploying strict Content-Security-Policy headers (particularly 'cross-origin-resource-policy: same-origin' and 'cross-origin-opener-policy: same-origin') on sensitive web applications can reduce the data surface exposed via cross-origin leakage, though this mitigates at the application layer rather than the browser and does not eliminate the underlying flaw.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today