EUVD-2026-50749
GHSA-739c-763r-27p8
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page, no auth required, but user must visit the page (UI:R); impact is confidentiality-only with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.
Technical ContextAI
Chrome's MediaRecording API provides browser-native audio and video capture and encoding capabilities. CWE-1300 (Improper Control of a Resource Through its Lifetime) points to a resource-lifecycle flaw in that subsystem - most likely a code path where memory buffers or objects are read or exposed before being fully initialized, or after their intended lifetime, allowing contents from the broader renderer or browser process address space to leak to web content. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the EUVD version ceiling of 151.0.7922.72 confirms the flaw exists in all shipping Chrome releases preceding that stable build. Because the issue is described as 'inappropriate implementation' rather than a classic buffer overflow or use-after-free, the root cause is an algorithmic or design error in how the MediaRecording component manages its memory resources relative to what it returns or exposes to JavaScript contexts.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later - this is the vendor-confirmed patched release per the stable-channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and Chromium issue tracker entry 514480948. Chrome's auto-update mechanism will deliver this release to most users automatically; administrators managing enterprise fleets should verify deployment via Google Admin Console or endpoint management tooling. No documented workaround for the underlying MediaRecording flaw exists; however, organizations with strict browser-control policies could temporarily disable access to MediaRecording API endpoints via enterprise policy (MediaStreamEnabled or ContentSettings), noting the trade-off that this disables legitimate audio and video capture features for all users on managed devices. Because user interaction is required for exploitation, enforcing Safe Browsing policies and URL filtering to block access to untrusted or newly-registered domains provides an additional compensating layer without functional impact on productivity.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today