PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17978 Google CVE debrief

A side-channel information leakage vulnerability in WebCodecs in Google Chrome prior to 151.0.7922.72 allows remote attackers to potentially obtain sensitive information from process memory via a crafted HTML page. This vulnerability exists in WebCodecs, a component of Google Chrome, and its exploitation could lead to information leakage. Defenders responsible for managing and securing Google Chrome installations should assess exposure and prioritize patching to prevent potential information leakage.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing and securing Google Chrome installations should assess exposure and prioritize patching to prevent potential information leakage.

Why it matters

CVE-2026-17978 is a side-channel information leakage vulnerability in WebCodecs in Google Chrome. Defenders should prioritize verifying and applying the vendor-provided patch to prevent potential information leakage. This vulnerability allows remote attackers to potentially obtain sensitive information from process memory via a crafted HTML page. The existence of this vulnerability in Chrome versions prior to 151.0.7922.72 necessitates immediate attention from defenders responsible for managing and securing Google Chrome installations.

  • Potential information leakage from process memory
  • Need to verify and apply patches to prevent exploitation
  • Monitoring for potential exploitation attempts is necessary

Technical summary

The vulnerability exists in WebCodecs in Google Chrome prior to 151.0.7922.72 and allows remote attackers to potentially obtain sensitive information from process memory via a crafted HTML page. The vulnerability is a side-channel information leakage issue, which could be exploited by attackers to gain access to sensitive information. Defenders should prioritize verifying and applying the vendor-provided patch to prevent potential information leakage.

Defensive priority

Defenders should prioritize verifying and applying the vendor-provided patch to prevent potential information leakage.

Recommended defensive actions

  • Verify and apply the vendor-provided patch to Google Chrome
  • Monitor for potential exploitation attempts
  • Review and update inventory of Chrome versions to ensure compliance with patched versions

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in Chrome versions prior to 151.0.7922.72 and the potential for information leakage.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17978 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17978

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17978 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17978

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.