EUVD-2026-50822
GHSA-m2jq-wwj8-85cc
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L), no attacker auth needed (PR:N), victim must visit page (UI:R), impact limited to partial cross-origin data leakage (C:L), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.
Technical ContextAI
The vulnerability is rooted in Google Chrome's Media subsystem, covering all versions prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). CWE-1300 (Improper Protection of Physical Side Channels) identifies the root cause class: a measurable, observable difference - such as resource load timing, cache state, or processing latency - in how the Media component handles cross-origin content. Side-channel attacks of this class exploit the fact that the browser's media pipeline leaves detectable traces accessible to JavaScript on the attacking page, even when direct cross-origin reads are blocked by the Same-Origin Policy. The flaw is contained within the browser sandbox scope (S:U), meaning it does not inherently enable host-level compromise, but it can be leveraged to infer protected data from other origins, such as authenticated session content or private API responses embedded in media.
RemediationAI
The primary remediation is to update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch; details are published in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's automatic update mechanism will deliver this patch to most users without manual action, but enterprise environments managing Chrome via policy should verify deployment through their endpoint management tooling. As a compensating control prior to patching, organizations can reduce exposure by enforcing web filtering to block access to untrusted or unknown HTML pages, which limits the attack surface but will impact user access to unreviewed sites. Chrome's strict site isolation (--site-per-process, enabled by default in recent versions) provides additional cross-origin boundary hardening but does not fully remediate this specific side-channel flaw. No workaround fully substitutes for the vendor patch.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today