EUVD-2026-50608
GHSA-x52f-23v9-fg5g
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page, no privileges needed, victim visit required; impact limited to partial cross-origin data disclosure with no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Technical ContextAI
The vulnerability resides in Chrome's favicon subsystem - the component responsible for fetching, caching, and displaying the small site icons shown in browser tabs and bookmarks. CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause class: the favicon loading or caching mechanism inadvertently exposes a side-channel that reveals cross-origin resource state, violating the browser's Same-Origin Policy isolation guarantees without requiring direct DOM access. This is consistent with known favicon-cache timing attacks, where a crafted page can probe whether another origin's resources have been loaded by observing favicon fetch behavior. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop releases before 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch. The stable channel advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism typically delivers this silently; IT administrators managing enterprise fleets should verify version compliance via endpoint management tooling and push the update where auto-update is restricted. No vendor-documented workaround exists for this specific flaw. As a compensating control for environments unable to patch immediately, restricting end-user access to untrusted or unsanctioned external websites via a corporate web proxy reduces the attack surface - this limits exposure but does not eliminate the underlying vulnerability. No significant side effects from the update itself have been noted in the vendor advisory.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today