CVE-2026-17978

CVE-2026-17978 is a side-channel vulnerability in Chromium's WebCodecs implementation that allows a malicious page to leak timing information from hardware-accelerated video encoding and decoding pipelines. This is not a logic bug in the media processing itself—it is the kind of information leakage that occurs when software observes hardware state that was never meant to be observable through timing side effects. The CVSS score is 5.3 (Medium), not Low; the Low classification was Chromium's internal rating which uses a different scale than CVSS. Regardless of the numeric rating, the vulnerability class matters more than the instance. The practical risk depends on your threat model. WebCodecs runs inside the browser process, and a successful exploit would allow a malicious origin to observe timing patterns that correlate with video content being processed by other origins sharing the same hardware encoder/decoder. This is a classic cross-origin information leak through shared hardware state. The attack requires the victim to be actively using WebCodecs on hardware that exposes observable timing differences—integrated GPUs and dedicated encoders are the likely targets, while software-only pipelines may show less differentiation. For defenders, the immediate actions are: confirm whether your Chrome or Edge versions are among those with the fix (the vulnerability was patched in a recent stable release; check your browser's about://version), understand that this affects any site using WebCodecs legitimately, and recognize that browser-based side-channel risks are structural to any API that provides hardware-level access. The broader pattern to watch is that WebGPU had similar side-channel issues before WebCodecs did—these are not isolated incidents but a recurring class where hardware access inevitably creates timing leakage that software mitigations can only partially address. If you deploy WebCodecs in security-sensitive contexts, treat hardware-accelerated encoding as a potential cross-origin leak vector and consider whether software-only encoding fallback is appropriate for your threat model.

Reviewed through automated stages and approved by a human before publication.