EUVD-2026-40758
GHSA-p9m4-pvg5-x6fg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Side-channel attacks require precise measurement conditions sensitive to hardware timers and browser noise mitigations, justifying AC:H over the vendor's AC:L; all other metrics align with the source vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Side-channel information leakage via the WebAudio API in Google Chrome prior to 150.0.7871.47 enables a remote attacker to extract cross-origin data from a victim's browser session through a crafted HTML page. The vulnerability abuses WebAudio's timing or spectral measurement capabilities to infer data that should be isolated by the Same-Origin Policy, exposing potentially sensitive cross-origin resources. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.17% at the 7th percentile reflects very low current exploitation probability; Chromium's own team rated the severity as Low despite the NVD's Medium (6.5) CVSS assignment.
Technical ContextAI
CWE-1300 (Improper Protection of Physical Side Channels) covers vulnerabilities where measurable side-effects of computation - such as timing differences, cache behavior, or spectral analysis - reveal information the attacker should not be able to access. In the WebAudio context, the W3C Web Audio API provides JavaScript-accessible primitives for audio processing, including precise timing and signal analysis. An attacker can craft measurements using AudioContext nodes (e.g., OscillatorNode, AnalyserNode, or ScriptProcessorNode) to induce observable timing variations correlated with cross-origin resource loading or data, effectively bypassing the browser's Same-Origin Policy through a covert channel. The vulnerability affects all platforms running Google Chrome (Chromium-based) prior to the 150.0.7871.47 stable channel release. No CPE string was provided in the source data, but the scope aligns with the Chromium engine across Windows, macOS, and Linux. The root cause class is analogous to browser-level Spectre-variant timing attacks applied through the audio processing pipeline.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability. Updates can be applied through Chrome's built-in update mechanism (Settings > About Google Chrome) or by downloading the latest stable channel installer from the Google Chrome website. The release advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No formal workarounds are documented by Google for this issue. Organizations managing Chrome deployments via enterprise policy may deploy the patch through Group Policy or Chrome Browser Cloud Management. As a temporary compensating control prior to patching, administrators can restrict JavaScript execution for untrusted sites via Content Security Policy or browser extension controls, though this trade-off significantly degrades legitimate web functionality. Restricting access to high-risk browsing contexts (e.g., blocking navigation to untrusted external URLs) reduces exposure without requiring application changes.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today