EUVD-2026-34537
GHSA-96m2-jm5m-f37f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory read in Google Chrome's Media component exposes sensitive process memory contents to attackers who have already compromised the renderer process. Specifically, Chrome versions prior to 149.0.7827.53 fail to initialize memory in the Media subsystem, enabling a secondary attacker-controlled read of arbitrary process memory via a crafted HTML page. EPSS stands at 0.03% (11th percentile), no public exploit has been identified, and this vulnerability is not listed in the CISA KEV catalog; the vendor-released patch is available in Chrome 149.0.7827.53.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes the root cause: memory allocated within Chrome's Media subsystem is accessed before it has been properly initialized, allowing prior heap or stack contents to be read. Chrome's multi-process architecture segregates rendering into sandboxed renderer processes; however, when a renderer is already compromised, this uninitialized read primitive can be leveraged to exfiltrate memory contents from that process - potentially including credentials, keys, or other sensitive data resident in memory. The vulnerability is confined to Chrome's Media component (the subsystem handling audio, video, and related media decoding) and is exploitable via a specially crafted HTML page delivered to the victim's browser.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability. The fix is detailed in the official stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome typically applies updates automatically; administrators managing enterprise deployments should verify fleet-wide version compliance via policy tooling. Because exploitation requires a pre-compromised renderer process, organizations should also prioritize patching any other Chrome vulnerabilities that could enable initial renderer compromise, as this vulnerability functions as a secondary stage in a chained attack. No effective workaround short of the patch mitigates this issue without disabling Media functionality broadly, which is impractical in most environments.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today