EUVD-2026-39038
GHSA-682p-m82j-vw29
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N and PR:N reflect network-delivered HTML vector with no authentication; AC:H captures mandatory prior renderer compromise; C:H reflects GPU memory read potential; I:N and A:N as read-only information disclosure with no write or denial impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized GPU memory use in Google Chrome prior to 149.0.7827.197 enables a second-stage attacker who has already compromised the renderer process to read sensitive data from GPU process memory via a crafted HTML page. Classified as CWE-457 (Use of Uninitialized Variable), the flaw creates an information disclosure path within Chrome's multi-process architecture. No public exploit exists, CISA has not listed this in KEV, and SSVC rates exploitation as none - but the C:H confidentiality impact rating reflects meaningful data exposure if an attacker successfully chains this with a renderer exploit.
Technical ContextAI
Google Chrome's multi-process architecture isolates rendering (renderer process) from graphics operations (GPU process) to enforce sandboxing. This vulnerability - CWE-457, Use of Uninitialized Variable - occurs within the GPU component, where a buffer or variable is read before initialization, leaving residual memory contents accessible to the calling context. GPU process memory may contain data buffered from multiple tabs or system-level GPU operations, making uninitialized reads a viable cross-context data exfiltration primitive. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome desktop platforms. The Chromium issue tracker reference (issues.chromium.org/issues/517080836) may provide additional implementation detail for analysts with access.
RemediationAI
Update Google Chrome to version 149.0.7827.197 or later, as detailed in the Google stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. Chrome's built-in auto-update mechanism will apply this patch automatically for most users; verify the installed version at chrome://settings/help. Enterprise administrators should enforce the update via Chrome Browser Cloud Management or Group Policy (ExtensionSettings, ChromeManagement policies) to ensure fleet-wide coverage. No targeted workaround exists for the GPU uninitialized memory issue in isolation. Residual risk reduction can be achieved by maintaining renderer sandbox integrity through keeping all Chrome components current, since exploitation of this flaw is gated entirely on a prior renderer compromise.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today