EUVD-2026-34565
GHSA-9rf5-w5jw-8vq5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory exposure in the ANGLE graphics layer of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity compromise is possible through this vector alone. With an EPSS score of 0.03% (11th percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is currently low despite the High confidentiality CVSS sub-score.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform abstraction layer that translates OpenGL ES API calls into platform-native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan elsewhere). CWE-457 (Use of Uninitialized Variable) indicates that a graphics-related data structure or buffer within ANGLE is allocated but not zeroed or otherwise initialized before use, leaving it populated with stale heap or stack contents from prior operations. Because ANGLE operates within the renderer process and handles attacker-influenced content (HTML/WebGL), a compromised renderer can craft calls into ANGLE that trigger reads of this uninitialized memory, exposing fragments of process memory - which may contain cookies, tokens, or other sensitive data resident in that process. The affected product range is Google Chrome versions prior to 149.0.7827.53, as confirmed by the ENISA EUVD entry EUVD-2026-34565.
RemediationAI
Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per Google's stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this fix to most users automatically; administrators managing enterprise deployments should verify the rollout via Google Update or their MDM solution. No specific workarounds exist to disable ANGLE without broadly disabling hardware-accelerated graphics, which would degrade browser performance. Because exploitation of this specific CVE requires prior renderer process compromise, organizations that have deployed Chrome's site isolation and sandbox hardening features (enabled by default in modern Chrome) already benefit from partial mitigation by limiting the blast radius of renderer compromises in general. No side effects have been reported for upgrading to 149.0.7827.53.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today