EUVD-2026-40756
GHSA-qqx3-3r9q-jch9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML with no attacker privileges; victim must visit the page (UI:R); only confidentiality is impacted through memory disclosure, no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Integer overflow in the WebNN component of Google Chrome prior to 150.0.7871.47 allows an unauthenticated remote attacker to read potentially sensitive data from Chrome's process memory. Exploitation requires convincing a victim to visit a crafted HTML page, placing this in the class of user-interaction-dependent browser memory disclosure vulnerabilities. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as 'none' and Chromium's own triage assigns 'Low' severity, suggesting the disclosed memory is constrained in practice.
Technical ContextAI
The WebNN (Web Neural Network API) component implements the W3C WebNN specification, enabling hardware-accelerated machine learning inference directly within web content - a relatively recent browser capability surfaced to JavaScript. An integer overflow in this subsystem (CWE-472 is listed in the advisory, but this classification - 'External Control of Assumed-Immutable Web Parameter' - is inconsistent with the description's explicit 'integer overflow'; CWE-190 would be the canonical mapping and the mislabeling should be verified with the Chromium team) allows crafted WebNN graph operations or tensor dimension values to cause incorrect memory addressing, leaking adjacent process memory contents back to the page context. The affected software is Google Chrome on desktop platforms, all versions prior to 150.0.7871.47.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later immediately; this is the vendor-confirmed fixed release per the Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise administrators should push the update via Google Admin Console, Microsoft Intune, or equivalent MDM tooling rather than relying on passive auto-update. As a pre-patch compensating control, restricting end-user navigation to untrusted or unknown web origins (via web proxy policy or browser extension allowlisting) reduces exposure but carries significant usability trade-offs and is not a substitute for patching. Chrome's renderer process sandbox limits the scope of any memory disclosure even on unpatched versions, providing partial risk reduction without configuration changes.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today