What is the CVSS score of CVE-2026-11123?

CVE-2026-11123 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11123?

Yes, a patch is available for CVE-2026-11123. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11123

EUVD-2026-34584 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-hm47-8pg5-gpcj

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 16:26 vuln.today

CVSS changed

Jun 08, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory read in Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows remote attackers to obtain sensitive process memory contents through a crafted HTML page, with no authentication required but mandatory user interaction. The vulnerability carries a CVSS Confidentiality impact of High (C:H), indicating potentially significant data exposure despite the Medium overall score of 6.5. EPSS is low at 0.03% (11th percentile) and no CISA KEV listing exists, meaning no public exploit or confirmed widespread exploitation has been identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction layer that translates OpenGL ES API calls to native graphics APIs including DirectX (Windows), Metal (macOS/iOS), and Vulkan. CWE-457 (Use of Uninitialized Variable) describes a condition where memory is allocated but not zeroed before use; when that memory is later read and its contents returned to a caller, previously resident heap or stack data may be disclosed. In a browser context, ANGLE processes WebGL and Canvas 2D rendering calls supplied by untrusted web content, making this attack surface directly reachable via crafted HTML. Graphics process memory can contain rendered frame data, textures, cross-origin image fragments, or other sensitive artifacts depending on browser activity at the time of exploitation. No CPE strings were provided in source data; the affected component is identified as ANGLE within Google Chrome as confirmed by the Chrome Releases advisory and ENISA EUVD-2026-34584.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch documented in the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's automatic update mechanism handles this for most end users; enterprise administrators using Chrome Browser Cloud Management or group policy should verify that managed endpoints have received and applied the 149.0.7827.53 update. As a pre-patch compensating control, enforcing Chrome's Site Isolation policy (--site-per-process, enabled by default in modern Chrome) limits cross-origin memory reuse within the renderer, partially reducing the information accessible via ANGLE memory disclosure - however, this does not patch the underlying CWE-457 condition and its effectiveness depends on implementation completeness. Disabling WebGL via enterprise policy (Chromebook or managed Chrome) eliminates the primary ANGLE attack surface but will break web applications relying on hardware-accelerated graphics, representing a significant functionality trade-off. Blocking untrusted external HTML sources via proxy or DNS-level controls reduces phishing delivery vectors but does not address the vulnerability directly.