Google Chrome EUVD-2026-50904

Exploitation requires the victim to actively navigate to or load a crafted HTML page in an unpatched Chrome desktop browser (UI:R). The attack complexity is rated High (AC:H), meaning the attacker must overcome inherent timing noise and measurement imprecision inherent to browser-based side-channel attacks - reliable exploitation is not trivial and requires fine-tuned tooling specific to target system characteristics. No authentication or privileges are required from the attacker's side (PR:N), but the attacker cannot reach victims passively; social engineering or a compromised/malicious ad network is required to deliver the page. Exploitation is further limited to information disclosure only - there is no code execution or integrity impact. Non-default configurations are not a prerequisite, as WebCodecs is available in standard Chrome. Scope is contained to the Chrome renderer process (S:U), so cross-process or OS-level memory is not directly accessible.

The overall real-world risk is moderate-to-low despite the C:H confidentiality rating. CVSS AC:H and UI:R jointly constrain exploitability: the attacker must craft a page that reliably induces timing-observable differences under realistic browser and OS noise conditions, while also compelling a victim to visit it. EPSS at 0.17% (7th percentile) strongly corroborates that mass exploitation is not occurring. SSVC rates the vulnerability as not automatable with only partial technical impact, reinforcing that spray-and-pray campaigns are not viable. No CISA KEV listing and no public proof-of-concept are present at time of analysis. The C:H rating, while accurate in scope, must be contextualised: side-channel exploits of this class typically require significant attacker effort per target and may not yield complete memory disclosure. The CVSS score of 5.3 (medium) is consistent with this balance. Priority should be standard patch cadence - not emergency response - for most organizations, with expedited patching warranted for environments where browser-based access to highly sensitive data (credentials, tokens, PII) is common.

An attacker crafts a malicious HTML page that uses the WebCodecs API to perform timed media decoding operations designed to induce measurable side-channel signals in the Chrome renderer process. The attacker distributes the page via phishing, malvertising, or a compromised website and waits for a targeted user to load it in an unpatched Chrome instance, at which point the timing oracle is used to infer contents of process memory such as authentication tokens or session state. No public proof-of-concept exists at time of analysis.