EUVD-2026-40505
GHSA-6wvm-hhm5-rv29
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Retained AV:N/UI:R/PR:N per Chrome web-model convention; C:H for memory disclosure and A:H for crash, I:N as no write occurs, though a prior renderer compromise is practically required.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds memory read in the ANGLE graphics component of Google Chrome on macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process read memory outside intended bounds via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it functions as a chained post-exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Technical ContextAI
The flaw resides in ANGLE (Almost Native Graphics Layer Engine), the abstraction layer Chrome uses to translate WebGL/OpenGL ES calls to the host platform's graphics backend (Metal on macOS). ANGLE runs inside the renderer/GPU pipeline and processes attacker-influenceable graphics commands, making it a recurring source of memory-safety bugs. The root cause is CWE-125 (Out-of-Bounds Read): the code reads from a buffer using an index or length not properly validated against the buffer's actual size, exposing adjacent heap memory that may contain sensitive data or corrupt program state leading to a crash. CPE cpe:2.3:a:google:chrome identifies Google Chrome as the affected product; the issue is scoped specifically to the macOS build per the description.
RemediationAI
Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on macOS via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); relaunch the browser to apply the update since Chrome stages updates but only activates them on restart. There is no product-specific workaround for a memory-safety bug of this type, but because exploitation requires a prior renderer compromise, keeping the rest of Chrome patched and the site-isolation sandbox enabled (default) limits an attacker's ability to reach this primitive; enterprises can enforce auto-update via managed policy to eliminate delayed restarts. Reducing exposure to untrusted web content (e.g., strict browsing policies) lowers the chance of the initial renderer compromise that this bug depends on, at the cost of usability.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today