EUVD-2026-50663
GHSA-9cfw-v2v5-c26g
Severity by source
Sources disagree (Low–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted HTML (AV:N) requires user to visit the page (UI:R) and precise side-channel execution (AC:H); no auth needed (PR:N); read-only memory leak with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
Technical ContextAI
Skia is Google's open-source 2D graphics rendering library, embedded directly in Chrome's rendering pipeline and responsible for painting all on-screen content. CWE-1300 (Improper Protection of Physical Side Channels) describes vulnerabilities where observable behavioral differences - such as cache timing, memory access patterns, or rendering latency - allow an attacker to infer internal state or memory contents without direct access. In this case, the side-channel manifests through Skia's rendering operations when processing attacker-controlled HTML/SVG content, leaking process memory that may include sensitive data from other open tabs or browser state. The affected product is confirmed by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions below 151.0.7922.72.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later, which is the vendor-released patch confirmed by the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this for most consumer and managed deployments; enterprise administrators should verify fleet compliance via Chrome Browser Cloud Management or their endpoint management tooling. Where immediate patching is operationally constrained, restricting navigation to untrusted external URLs via a proxy allowlist or DNS filtering reduces exposure, though this trades web accessibility for risk reduction. Disabling JavaScript will prevent the crafted HTML page from triggering the side-channel in most realistic attack scenarios, but at severe functional cost. Given AC:H and UI:R, no-click exploitation is not expected, so user awareness training against untrusted links provides marginal compensating value.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today