EUVD-2026-33160
GHSA-3q74-cwq3-c724
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Integer overflow in ANGLE (Chrome's graphics translation layer) in Google Chrome prior to 148.0.7778.216 enables remote attackers to read sensitive data from the renderer process memory by enticing a victim to visit a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity impact is indicated by CVSS (C:H/I:N/A:N). With an EPSS of 0.03% and no CISA KEV listing, active exploitation is not currently observed, though the network-accessible attack vector and low complexity make the attack straightforward once a victim visits attacker-controlled content.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is an open-source graphics abstraction library bundled within Google Chrome that translates OpenGL ES 2/3 API calls into platform-native graphics APIs - Direct3D on Windows, Metal on macOS, and Vulkan or desktop OpenGL on Linux. An integer overflow in ANGLE can corrupt internal size or offset calculations, leading to an out-of-bounds read of heap memory within the renderer process. The assigned CWE is CWE-472 ('External Control of Assumed-Immutable Web Parameter'), which is atypical for an arithmetic integer overflow - CWE-190 (Integer Overflow or Wraparound) would conventionally apply here. This CWE mismatch may indicate the overflow is triggered through an attacker-controlled parameter passed from a web page into the ANGLE pipeline, which would align the two CWEs. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms running Chrome versions before 148.0.7778.216.
RemediationAI
The primary fix is to upgrade Google Chrome to version 148.0.7778.216 or later, which contains the vendor-released patch as documented in the Chrome stable channel release advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome auto-updates by default on most platforms; administrators managing enterprise fleets should verify deployment of this version via policy. For environments where immediate upgrade is not feasible, the most effective compensating control is to restrict or supervise user browsing to untrusted sites - particularly blocking access to unvetted external HTML content - since exploitation requires visiting a crafted page. Additionally, deploying browser isolation solutions or sandboxing (e.g., Chrome Site Isolation) can limit the practical impact of memory reads by confining what data is accessible within a renderer process. Note that disabling hardware acceleration (which would bypass ANGLE for some rendering paths) is a potential workaround but carries significant rendering performance trade-offs and is not verified to fully eliminate the attack surface.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today