Description

Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:17:46.620Z",
  "pubdate": "2026-08-25T21:17:46.620Z",
  "executiveSummary": "A security vulnerability categorized as an information leak exists within the QUIC protocol implementation in Google Chrome prior to version 152.0.7977.65.\nThe flaw allows a remote attacker to bypass privacy boundaries and gain access to sensitive information through the delivery of a specifically crafted HTML page.\nThis vulnerability is classified as Medium severity by the Chromium security team.\nThe attack is executed remotely and does not require elevated privileges or authentication on the target system, leveraging the browser's handling of QUIC connections to disclose data.\nThe impact involves the unauthorized exposure of potentially sensitive state or transmission data, which could be leveraged to facilitate further exploitation or privacy compromise for the end user.\nSuccessful exploitation depends on the victim rendering the malicious HTML content, which subsequently triggers the flawed interaction within the QUIC protocol stack.",
  "technicalDetails": "The vulnerability resides in the Chromium networking stack's implementation of the QUIC (Quick UDP Internet Connections) protocol. QUIC is designed to provide low-latency, multiplexed connections; however, improper handling of protocol-specific state or headers during connection establishment or error recovery allows for a cross-origin or cross-context information disclosure.\nThe root cause involves the improper isolation of QUIC session data or internal protocol structures when interacting with the rendering engine. When a crafted HTML page is loaded, it can initiate network requests that trigger specific, malformed, or unexpected QUIC connection behaviors.\nAttack flow: First, an attacker hosts a malicious HTML page on a server reachable by the target browser. Upon the victim navigating to this page, the browser's rendering engine executes scripts that induce the QUIC transport layer to perform specific handshake or stream management actions. Due to the lack of sufficient validation or boundary checking in the QUIC implementation, the protocol engine may leak internal buffer contents, protocol state, or potentially sensitive memory segments into the response stream handled by the attacker's script.\nThe exposure occurs because the QUIC implementation fails to scrub or isolate protocol-level information before it becomes accessible to the user-space rendering context. This permits the attacker to extract information that should have remained restricted to the browser's protected memory space or limited to encrypted, legitimate protocol traffic.\nAffected versions include all Chromium-based implementations prior to 152.0.7977.65. This issue is network-exposed, meaning any webpage processed by the browser can serve as the attack vector. There are no authentication or privilege requirements for the attacker, as the exploit relies on standard browser networking behavior to induce the flaw.\nPost-exploitation, the attacker can aggregate the leaked information to map internal browser state, identify user session identifiers, or perform side-channel analysis that bypasses existing Same-Origin Policy (SOP) protections. Because this is an information leak, it serves as a critical primitive for more complex multi-stage attacks aimed at persistent monitoring or deanonymization of the user within the networking layer."
}