Description
Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-06
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Upgrade Chrome
AI Analysis

Impact

An information‑leak vulnerability was discovered in the WebAudio API of Google Chrome. Prior to version 155.0.8059.39 a crafted HTML page could cause the browser to expose cross‑origin data to a remote attacker, potentially revealing sensitive media or user data. The flaw is identified as CWE‑200 and is rated as a medium severity security issue by Chromium.

Affected Systems

Google Chrome versions earlier than 155.0.8059.39 on any supported platform are affected. The vulnerability is triggered through web content delivered to an end‑user’s browser.

Risk and Exploitability

The vulnerability can be exploited remotely by hosting a malicious webpage that triggers the vulnerable WebAudio path. The CVSS score is 4.3, and no EPSS score is available; the issue is not listed in CISA KEV, but the medium severity combined with the remote attack vector suggests a non‑negligible risk. Chrome users running older builds should update promptly to mitigate the risk.

Generated by OpenCVE AI on October 7, 2026 at 02:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 155.0.8059.39 or later.
  • If immediate upgrade is not possible, disable WebAudio for untrusted sites via Chrome policy or command‑line flags.
  • Subscribe to Chrome security release announcements for timely updates and monitor the Chromium issue tracker for further remediation notes.

Generated by OpenCVE AI on October 7, 2026 at 02:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Fri, 09 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Information leak in WebAudio
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Title Cross-Origin Information Leak via WebAudio in Chrome

Tue, 06 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Cross-Origin Information Leak via WebAudio in Chrome
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-200
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T21:16:16.209Z

Reserved: 2026-10-06T16:37:35.686Z

Link: CVE-2026-106392

cve-icon Vulnrichment

Updated: 2026-10-06T21:11:21.576Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:08.557

Modified: 2026-10-07T13:41:09.610

Link: CVE-2026-106392

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T18:41:23Z

Links: CVE-2026-106392 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T03:30:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor