EUVD-2026-40495
GHSA-rj5f-97jf-7rw8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory renderer-process compromise prerequisite; all other metrics follow CVSS guidance and description impact scope.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Side-channel information leakage in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage via side-channel in Google Chrome's Safe Browsing component on iOS affects all Chrome versions prior to 150.0.7871.47, exploitable only by an attacker who has already compromised the renderer process. The vulnerability (CWE-1300) allows confidentiality impact through a crafted HTML page that abuses Safe Browsing timing or state signals to exfiltrate data across origin boundaries. No public exploit code exists at time of analysis, SSVC records exploitation as none, and EPSS probability sits at 0.21% (11th percentile), reflecting the significant prerequisite of prior renderer compromise.
Technical ContextAI
CWE-1300 (Improper Protection of Physical Side Channels) classifies this as a side-channel leakage flaw - a class where observable differences in system behavior (timing, cache state, resource loading patterns) betray information that should be isolated. Google Chrome's Safe Browsing feature evaluates URLs and HTML content against threat intelligence; in doing so it may produce measurable behavioral differences when processing cross-origin content, which a compromised renderer can observe and exploit. The iOS platform is specifically affected, as Chrome on iOS operates under Apple's WebKit/WKWebView constraints rather than the Blink renderer used on desktop, potentially making the side-channel surface differ from desktop Chrome. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome builds, but the description limits the vulnerability to the iOS variant prior to 150.0.7871.47.
RemediationAI
Update Google Chrome on iOS to version 150.0.7871.47 or later, which contains the vendor-released patch. The fix is documented in the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Update delivery is handled through the Apple App Store for iOS users. If immediate update is not possible, organizations can reduce exposure by restricting access to untrusted web content on iOS devices that handle sensitive cross-origin data, or by enforcing mobile device management (MDM) policies that limit browsing to managed, trusted sites - though these controls are organizational rather than technical mitigations for the vulnerability itself. There is no documented workaround that disables Safe Browsing in a way that eliminates the side-channel without also removing that security feature.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today