What is the CVSS score of EUVD-2026-30379?

EUVD-2026-30379 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30379?

Yes, a patch is available for EUVD-2026-30379. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-30379

| CVE-2026-8562 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-05-14 Chrome

GHSA-78r2-4fcw-vg59

Google Information Disclosure Red Hat Suse Chrome

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 15:25 vuln.today

CVSS changed

May 15, 2026 - 15:22 NVD

4.3 (MEDIUM)

CVE Published

May 14, 2026 - 19:52 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Side-channel information leakage in Navigation in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.168 enables remote attackers to extract sensitive information from other origins through side-channel attacks in the Navigation component. The vulnerability requires user interaction with a malicious HTML page and exploits timing or behavioral characteristics to bypass same-origin policy protections. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis. Google has released a patch in Chrome 148.0.7778.168.

Technical ContextAI

This vulnerability stems from CWE-1300 (Improper Protection of Physical Side Channels), a class of information disclosure flaws where observable system behaviors-such as timing variations, cache states, or resource allocation patterns-leak sensitive data across security boundaries. In Chrome's Navigation component, the side channel likely manifests through measurable differences in navigation timing, resource loading behavior, or JavaScript execution patterns that vary based on cross-origin content. Side-channel attacks exploit legitimate system functionality rather than traditional memory corruption, making them particularly challenging to detect and mitigate without performance trade-offs. The affected CPE (cpe:2.3:a:google:chrome) encompasses all Chrome installations across desktop platforms (Windows, macOS, Linux) running versions below the patched release.

RemediationAI

Upgrade to Google Chrome version 148.0.7778.168 or later, available through automatic updates or manual download from google.com/chrome. The patch is documented in Google's stable channel update advisory at chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html with technical details in Chromium issue tracker 40057534 at issues.chromium.org/issues/40057534. Enterprise deployments using managed Chrome installations should push the update through group policy or mobile device management systems. If immediate patching is not feasible, implement compensating controls including browser isolation technologies (such as Chromium Application Guard or remote browser isolation solutions) to sandbox untrusted web content, though this introduces latency and may break some web application functionality. Restrict navigation to trusted domains via content security policies where possible, though this provides only partial mitigation as side channels may still be exploitable within permitted origins. No configuration-based workaround fully mitigates the vulnerability without patching.