EUVD-2026-50709
GHSA-7q95-h4cm-34v8
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring victim visit (UI:R, PR:N); leakage is limited cross-origin inference only (C:L), with no write or DoS capability possible.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Side-channel information leakage in NoStatePrefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.
Technical ContextAI
NoStatePrefetch is a Chrome browser optimization that pre-fetches page resources in the background without executing JavaScript or retaining full renderer state, intended to accelerate subsequent navigation. CWE-1300 (Improper Protection of Physical Side Channels) applies when internal processing produces measurable side effects - such as timing differentials, cache occupancy changes, or network timing - that leak information to an observer. In this case, an attacker-controlled page can trigger and monitor NoStatePrefetch behavior to infer the state or content of cross-origin resources loaded by the victim browser, bypassing the Same-Origin Policy at the side-channel layer rather than through a direct access bypass. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, spanning all desktop Chrome builds prior to the fixed release.
RemediationAI
The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later, as documented in the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism should handle this for most users; enterprise administrators should verify forced update policies are current. As a compensating control where immediate upgrade is operationally blocked, organizations can disable the NoStatePrefetch feature via Chrome enterprise policy (set PrerenderingAllowed or equivalent prefetch flags to disabled through Group Policy or Managed Preferences); note that doing so will degrade page load performance for users. User awareness guidance to avoid visiting untrusted or unsolicited web pages is a secondary but practical control given the UI:R requirement.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today