Description
Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is a side‑channel leak in Chrome’s WebAudio component that, when triggered from a malicious web source, represents an information‑exposure weakness (CWE-1300) and a timing side‑channel (CWE-203).

Affected Systems

The vulnerability affects Google Chrome for desktop built from the Chromium source tree and present in all releases older than 150. No other vendors or product families are affected; the impact is limited to browsers from that codebase.

Risk and Exploitability

The CVSS score of 6.5 indicates medium risk, while the EPSS score of < 1 % reflects the low likelihood of exploitation at the time of this analysis. The flaw is not listed in CISA’s KEV catalog. An attacker would need to persuade a user to load a crafted page in a vulnerable Chrome instance. Based on the description, it is inferred that user interaction is required. The vulnerability does not enable code execution or denial of service, but it does compromise confidentiality across origin boundaries.

Generated by OpenCVE AI on July 15, 2026 at 23:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 150.0.7871.47 or later, which resolves the WebAudio side‑channel issue.
  • If an immediate update is not feasible, apply enterprise policies to block or limit the WebAudio API for untrusted content, or deploy a browser extension that disables audio processing on foreign pages.
  • Monitor Chrome security advisories and promptly apply subsequent patches once they are released.

Generated by OpenCVE AI on July 15, 2026 at 23:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4672-1 chromium security update
Debian DSA Debian DSA DSA-6378-1 chromium security update
History

Wed, 15 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio API in Google Chrome

Tue, 14 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leakage via WebAudio Side-Channel in Chrome

Sun, 12 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Cross-Origin Data Leakage via WebAudio Side-Channel in Chrome

Sat, 11 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Title WebAudio Side‑Channel Leak Enabling Cross‑Origin Data Leakage

Fri, 10 Jul 2026 04:00:00 +0000

Type Values Removed Values Added
Title WebAudio Side‑Channel Leak Enabling Cross‑Origin Data Leakage

Thu, 09 Jul 2026 02:45:00 +0000

Type Values Removed Values Added
Title Side‑channel information leakage in Chrome’s WebAudio enabling cross‑origin data extraction

Wed, 08 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
Title Side‑channel information leakage in Chrome’s WebAudio enabling cross‑origin data extraction

Tue, 07 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Google Chrome

Mon, 06 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Google Chrome

Sun, 05 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Timing Side‑Channel in Google Chrome

Sun, 05 Jul 2026 03:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Timing Side‑Channel in Google Chrome

Fri, 03 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Google Chrome

Fri, 03 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Google Chrome

Thu, 02 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Google Chrome

Thu, 02 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Google Chrome

Thu, 02 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title WebAudio Side‑Channel Leakage in Chrome

Wed, 01 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title WebAudio Side‑Channel Leakage in Chrome

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-203
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Chrome

Wed, 01 Jul 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 01 Jul 2026 02:15:00 +0000

Type Values Removed Values Added
Title Cross‑Origin Data Leakage via WebAudio Side‑Channel in Chrome

Tue, 30 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-1300
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-01T12:54:48.810Z

Reserved: 2026-06-29T23:11:36.297Z

Link: CVE-2026-14071

cve-icon Vulnrichment

Updated: 2026-07-01T12:54:40.495Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-15T23:30:04Z

Weaknesses
  • CWE-1300

    Improper Protection of Physical Side Channels

  • CWE-203

    Observable Discrepancy