EUVD-2026-40559
GHSA-x7w5-522m-wp35
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML with no privileges needed; mandatory user page-visit limits scope; impact is confidentiality-only from memory read with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in Chrome's Layout engine prior to 150.0.7871.47 allows remote attackers to leak potentially sensitive data from the renderer process memory by serving a crafted HTML page. User interaction is required - the victim must visit the malicious page - limiting automated mass exploitation. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, placing real-world urgency below what the CVSS 6.5 score alone might suggest.
Technical ContextAI
The vulnerability resides in Chrome's Layout engine, the subsystem responsible for computing visual positioning and sizing of DOM elements during page rendering. When processing a specially crafted HTML document, the engine reads beyond the allocated bounds of an internal buffer - an out-of-bounds read condition - potentially exposing adjacent renderer process memory contents. The assigned CWE is CWE-787 (Out-of-bounds Write), which conflicts with the CVE description specifying a read; this discrepancy should be verified via the Chromium issue tracker at https://issues.chromium.org/issues/498085466. Exploiting memory disclosure in a sandboxed renderer process is non-trivial, as the attacker must identify and extract meaningful data (e.g., cached credentials or tokens) from the leaked region. The flaw affects all desktop platform builds of Chrome prior to 150.0.7871.47.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch for this vulnerability. Updates can be applied via the browser's built-in mechanism (Help > About Google Chrome > update prompt) or through enterprise deployment tools such as Google Update or MSI packages. The official release advisory is at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For organizations unable to patch immediately, restricting user access to untrusted or external web content via a web proxy or enterprise browser isolation solution can reduce exposure, though these controls introduce operational overhead and do not fully eliminate risk from attacker-influenced legitimate sites.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today