Description
Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-09-15
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

An observed discrepancy in CSS prior to 153.0.8010.47 allows a remote attacker to craft a malicious HTML page that leaks sensitive information. The vulnerability is described as a CWE‑203 and CWE‑204 issue, which refers to information disclosure through inconsistent data handling. The description does not specify the exact type of data that can be exposed, but it is inferred that the attacker can read values that should be hidden by CSS rules, potentially leading to confidentiality loss.

Affected Systems

Google Chrome browsers running any version before 153.0.8010.47, across all supported operating systems, are affected by this rendering bug.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1%. The likely attack vector is remote, whereby an attacker serves a crafted HTML page to a victim’s browser. The vulnerability is not listed in CISA’s KEV catalog, implying no widespread exploitation is currently documented.

Generated by OpenCVE AI on September 22, 2026 at 13:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 153.0.8010.47 or newer.
  • Enable automatic updates to receive security patches promptly.
  • If an immediate update is not possible, restrict or block the loading of external CSS and HTML resources from untrusted origins to mitigate the risk.

Generated by OpenCVE AI on September 22, 2026 at 13:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Tue, 22 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Observable discrepancy in CSS
Weaknesses CWE-204
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 18 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Title CSS Information Disclosure in Google Chrome Prior to 153.0.8010.47

Thu, 17 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 16 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Title CSS Information Disclosure in Google Chrome Prior to 153.0.8010.47

Wed, 16 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 15 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-203
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-16T10:14:09.118Z

Reserved: 2026-09-14T22:52:01.641Z

Link: CVE-2026-91725

cve-icon Vulnrichment

Updated: 2026-09-16T10:14:03.389Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T21:16:45.723

Modified: 2026-09-17T17:53:27.790

Link: CVE-2026-91725

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-15T20:41:35Z

Links: CVE-2026-91725 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T14:00:19Z

Weaknesses
  • CWE-203

    Observable Discrepancy

  • CWE-204

    Observable Response Discrepancy