The vulnerability stems from a mismatch in cipher suite selection in the uTLS library when GREASE ECH is used with the Chrome parrot implementation. uTLS hardcodes an AES preference for the outer ClientHello but selects the ECH cipher suite randomly between AES and ChaCha20. This yields a 50% chance of sending an outer AES cipher suite paired with an inner ChaCha20 suite, a combination that Chrome will never generate. The resulting fingerprint discrepancy allows observers to distinguish traffic that uses the vulnerable uTLS version from genuine Chrome traffic, exposing the use of the library.

Affected products are the refraction-networking uTLS library, specifically all releases from 1.6.0 through 1.8.0. The breach impacts any application that incorporates this library to customize TLS handshakes, such as proxies, load balancers, or custom clients that target Chrome fingerprint resistance. No operating system or external components are involved; the issue is confined to the TLS implementation within the library.

The CVSS score of 2.3 indicates a low severity, and the EPSS probability is below 1%, with no entry in CISA’s KEV catalog. Because the flaw only reveals a fingerprinting signature, there is no direct path to compromise confidentiality, integrity, or availability, and the attack requires that the adversary observe the TLS traffic. Consequently, the risk is minimal – a user‑facing privacy concern rather than a critical security vulnerability. Mitigation involves applying the official fix, but alternatives are available for immediate use.