EUVD-2026-40804
GHSA-576h-mqx3-98ph
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page (AV:N) but AC:H for required UI gesture sequence; C:H for process memory read; I:N and A:N as no write or crash capability is described.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Memory disclosure via DevTools in Google Chrome on Windows (prior to 150.0.7871.47) enables a remote attacker to read sensitive process memory contents by delivering a crafted HTML page and manipulating the victim into performing specific UI gestures. The vulnerability is Windows-platform-exclusive and carries a Chromium-internal severity of Low, consistent with SSVC's assessment of no current exploitation and non-automatable delivery. No active exploitation or public exploit code has been identified at time of analysis, though the CVSS C:H rating reflects meaningful confidentiality risk if successfully triggered.
Technical ContextAI
Google Chrome's DevTools component - the browser-integrated developer toolset accessible via F12 or context menus - fails to properly validate untrusted input sourced from web content, classified under CWE-20 (Improper Input Validation). This class of flaw typically arises when content-supplied data is passed into memory inspection or rendering routines without sanitization, potentially causing out-of-bounds reads or type-confusion reads that expose adjacent heap or stack memory. The vulnerability is scoped to the Windows platform, indicating a platform-conditional code path in DevTools rather than a universal Chromium engine flaw. The CVSS vector (AV:N/AC:H/UI:R) confirms the attack is network-delivered via crafted HTML but requires both high attack complexity and active user interaction - specifically, 'specific UI gestures' which likely involves a sequence of DevTools interactions triggered or prompted by the malicious page. No CPE strings were provided; the affected version range is inferred from the EUVD entry listing Chrome versions prior to 150.0.7871.47.
RemediationAI
Update Google Chrome on Windows to version 150.0.7871.47 or later, as documented in the Chrome stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; enterprise administrators should verify deployment via Chrome Browser Cloud Management or policy enforcement and confirm the build version through chrome://version. As a compensating control prior to patching, organizations can restrict DevTools access using the Chrome enterprise policy 'DevToolsAvailability' set to 2 (disabled), which eliminates the vulnerable code path entirely - though this prevents legitimate developer use on managed endpoints. Blocking untrusted external HTML pages via web filtering reduces exposure for non-developer user populations. The patch version 150.0.7871.47 is confirmed by both the Chrome Releases advisory and the EUVD entry.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today