EUVD-2026-28101Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted HTML mandates user page visit (UI:R); memory leak is scoped to renderer process (S:U) with only partial confidentiality loss and no write or denial-of-service impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.
Technical ContextAI
The flaw resides in V8, Google Chrome's open-source JavaScript and WebAssembly engine responsible for parsing and executing JavaScript in the renderer process. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) classifies the root cause as an inappropriate implementation within V8 that inadvertently surfaces process memory contents - likely heap or stack data - that web content should not be able to observe. V8 manages complex memory layouts for JIT-compiled code, object heaps, and execution contexts; implementation gaps in bounds checking, type handling, or memory initialization can produce observable information leaks without triggering a crash. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 148.0.7778.96. Tags also indicate downstream Chromium-based packages for Red Hat and SUSE are in scope.
RemediationAI
Upgrade Google Chrome to version 148.0.7778.96 or later; this is the vendor-confirmed fixed release documented in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deliver this fix automatically to most users; administrators should verify deployment via chrome://settings/help or enterprise management consoles. For Red Hat and SUSE environments running distribution-packaged Chromium, monitor vendor security channels for updated RPM or DEB packages incorporating this fix - timelines will vary by distro. As a compensating control prior to patching in managed environments, restrict navigation to untrusted external web content via enterprise browser policies (e.g., URL allowlisting, SafeBrowsing enforcement) to reduce exposure to crafted pages; note this trade-off reduces general browsing capability.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today