Google Chrome EUVD-2026-30379

Requires user interaction: victim must navigate to or be tricked into visiting an attacker-controlled HTML page. The Navigation component must be actively used to process cross-origin requests during the attack window. No authentication, special browser configuration, or elevated privileges required-exploitation succeeds against default Chrome installations (PR:N from CVSS vector). Attack effectiveness depends on attacker's ability to perform sufficient measurements for side-channel analysis, which may require the victim to remain on the malicious page for an extended period or interact with it multiple times. Cross-origin data must be accessible through observable navigation behaviors for successful information extraction. The vulnerability's scope is unchanged (S:U in CVSS), meaning the attacker cannot leverage Chrome to compromise resources beyond the browser's security context.

Real-world risk is moderate-low based on converging signals. CVSS 4.3 (Medium) reflects the network attack vector (AV:N) with low complexity (AC:L) but critically requires user interaction (UI:R) and only impacts confidentiality at low severity (C:L) with no integrity or availability impact. The EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity in the wild, consistent with the technical barriers of side-channel attacks which typically require precise timing measurements and multiple requests to extract meaningful data. User interaction requirement (visiting attacker-controlled HTML page) significantly limits attack surface compared to drive-by exploitation. No KEV listing or public proof-of-concept further supports low immediate threat. However, information disclosure vulnerabilities affecting same-origin policy enforcement warrant attention in high-security environments where cross-origin data isolation is critical, such as enterprise SSO portals or cloud application platforms. Priority should be moderate for general deployments but elevated for organizations handling sensitive cross-domain authentication flows.

An attacker hosts a malicious website containing carefully crafted HTML and JavaScript that leverages timing measurements or behavioral observation of Chrome's Navigation component. When a victim visits the malicious page (through phishing, malvertising, or compromised legitimate site), the attacker's code initiates cross-origin navigations or resource requests while measuring subtle timing differences or state changes in the browser's navigation handling. By analyzing these side-channel signals across multiple requests, the attacker infers the presence, structure, or content of data from other origins the user has accessed, potentially including authentication states, personalized content, or sensitive identifiers that should be protected by same-origin policy.