EUVD-2026-35222
GHSA-v3jc-6f63-gr4g
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Video in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory use in the Video component of Google Chrome on Windows (prior to 149.0.7827.103) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by directing the victim to a crafted HTML page. The vulnerability is Windows-specific, rated High severity by Chromium's internal scale, and carries a CVSS 5.3 due to the high attack complexity and required user interaction stacking atop the renderer-compromise prerequisite. No public exploit identified at time of analysis; Google has released a fix in version 149.0.7827.103.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a class of bug where memory is allocated but not zeroed or otherwise set before use, causing the program to read and potentially expose stale heap or stack contents. In this case the affected subsystem is Chrome's Video component within the renderer process on Windows. The Windows-specific scope likely reflects platform differences in memory allocator behavior or how the Video pipeline initializes buffers under the Win32 graphics stack. Because Chrome's renderer is sandboxed, this vulnerability is not directly reachable from the network in isolation - it requires a pre-existing renderer compromise, making it a second-stage information-disclosure primitive rather than an entry-point vulnerability. No CPE strings were provided in the source data; affected scope is identified via EUVD-2026-35222 and the NVD description as Google Chrome on Windows prior to 149.0.7827.103.
RemediationAI
Update Google Chrome on Windows to version 149.0.7827.103 or later - this is the vendor-released patch confirmed by both the Google Stable Channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html) and EUVD-2026-35222. Enterprise administrators can enforce this update via Chrome Browser Cloud Management or Windows Group Policy (update policy: UpdateDefault or TargetVersionPrefix). As a compensating control prior to patching, restricting users from browsing untrusted or external web content reduces the crafted-HTML delivery surface, though this is operationally disruptive. Since exploitation requires a prior renderer compromise, maintaining a fully patched Chrome build with no outstanding renderer RCE vulnerabilities (which would serve as the prerequisite exploit) is equally important - this vulnerability has no impact if no renderer exploit is available to the attacker. No workaround exists that disables the Video component without disabling broad browser functionality.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today