Description
Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-07-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a side-channel information leakage in WebCodecs, allowing a remote attacker to read potentially sensitive data from process memory through a crafted HTML page. The incident can expose confidential user data without requiring authentication or code execution, representing a data disclosure flaw.

Affected Systems

Google Chrome versions prior to 151.0.7922.72 are affected; the issue is present in the Chrome browser shipped by Google.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves a malicious web page in the user’s browser; a remote attacker must convince a user to visit the crafted page, after which the side‑channel leak can be triggered.

Generated by OpenCVE AI on August 3, 2026 at 11:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.72 or later, which contains the security fix for the WebCodecs side‑channel leak
  • If an immediate upgrade is impractical, block or disable WebCodecs via an enterprise policy or by using the command‑line flag "--disable-features=WebCodecs" to prevent the feature from executing
  • Maintain an automated update policy that queries Google’s release page to ensure the browser stays current with security patches

Generated by OpenCVE AI on August 3, 2026 at 11:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Sat, 01 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title Side-Channel Leak in WebCodecs via Crafted HTML chromium-browser: chromium-browser: Side-channel information leakage in WebCodecs
Weaknesses CWE-205
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 31 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Title Side-Channel Leak in WebCodecs via Crafted HTML

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-1300
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T18:20:01.210Z

Reserved: 2026-07-27T23:37:12.011Z

Link: CVE-2026-17978

cve-icon Vulnrichment

Updated: 2026-07-30T18:19:53.629Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:17:02.370

Modified: 2026-08-03T17:07:56.630

Link: CVE-2026-17978

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-30T00:25:52Z

Links: CVE-2026-17978 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T11:45:03Z

Weaknesses
  • CWE-1300

    Improper Protection of Physical Side Channels

  • CWE-205

    Observable Behavioral Discrepancy