Description
Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-13
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Remote Data Leakage
Action: Patch
AI Analysis

Impact

Google Chrome versions before 155.0.8059.79 contain a media handling flaw that allows a remote attacker to craft an HTML page triggering an observable discrepancy in media processing. The discrepancy permits the attacker to read cross‑origin data that should be inaccessible, an information‑exposure vulnerability that compromises confidentiality.

Affected Systems

The flaw is found in Google Chrome as distributed by Google. Any installation of Chrome older than version 155.0.8059.79 is affected. Based on the description, it is inferred that the component involved is the media processing subsystem that handles audio or video rendering.

Risk and Exploitability

The CVSS score of 3.1 indicates a low overall severity, but Chromium lists the severity as high. The EPSS score of less than 1% indicates a very low probability of exploitation under current conditions, and the flaw is not present in CISA’s KEV catalog. Attackers would need to host a crafted web page and luring a user to visit it; the vulnerable client then leaks cross‑origin data from the page.

Generated by OpenCVE AI on October 16, 2026 at 02:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 155.0.8059.79 or later to eliminate the media handling flaw.
  • Configure browser policies to block or restrict access to potentially malicious domains if possible, limiting the attack surface for crafted pages.
  • Review site‑wide content security policies to enforce same‑origin restrictions, reducing the impact of any future media discrepancies.

Generated by OpenCVE AI on October 16, 2026 at 02:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4838-1 chromium security update
Debian DSA Debian DSA DSA-6562-1 chromium security update
History

Wed, 14 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Vendors & Products Google
Google chrome

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Wed, 14 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Observable discrepancy in Media
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 13 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-203
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-14T13:20:10.440Z

Reserved: 2026-10-13T16:48:47.322Z

Link: CVE-2026-110141

cve-icon Vulnrichment

Updated: 2026-10-14T13:20:02.731Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T22:17:33.890

Modified: 2026-10-14T17:57:53.677

Link: CVE-2026-110141

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-13T21:01:46Z

Links: CVE-2026-110141 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T10:30:07Z

Weaknesses