EUVD-2026-40703
GHSA-x63f-3c5p-f7p4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Race condition (CWE-362) requires winning a timing window, warranting AC:H over the vendor-assigned AC:L; all other metrics reflect unauthenticated, user-interaction-required cross-origin disclosure with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) signals low near-term exploitation probability despite the CVSS High confidentiality impact - consistent with Chromium's own 'Medium' severity designation and the inherent timing-sensitivity of race condition attacks.
Technical ContextAI
The vulnerability lies in Chrome's WebRTC (Web Real-Time Communication) implementation - a browser subsystem providing peer-to-peer audio, video, and data channels via JavaScript APIs. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) identifies the root cause as a race condition: two or more concurrent threads or asynchronous operations compete over shared WebRTC state without adequate synchronization, creating a window where cross-origin data can be accessed before the browser's Same-Origin Policy enforcement is fully applied. The Windows-only scope (stated explicitly in the CVE description) suggests a platform-specific threading or IPC model difference in Chrome's process architecture on Windows. The EUVD entry EUVD-2026-40703 confirms the affected version range as all Chrome releases below 150.0.7871.47. No CPE strings were provided in the intelligence feed.
RemediationAI
Update Google Chrome on Windows to version 150.0.7871.47 or later immediately; this is the vendor-released patch confirmed in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In enterprise environments, deploy the update via Google Update, Chrome Browser Cloud Management, or group policy. For managed fleets where immediate patching is constrained, disabling WebRTC via Chrome enterprise policy (setting WebRtcAllowed to false) eliminates the vulnerable attack surface, but will break web-based video conferencing, VoIP, and any WebRTC-dependent business applications - assess operational impact before applying. Web content filtering to block navigation to untrusted external sites reduces exposure by preventing victims from reaching attacker-controlled pages, though this is not a substitute for patching.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today