EUVD-2026-40663
GHSA-qmm5-xxxq-q4f8
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; C:H applies since process memory may contain high-value secrets; no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction engine, enables sensitive process memory disclosure on macOS for attackers who have already compromised the renderer process. Affected versions are Google Chrome prior to 150.0.7871.47 on Mac; Windows and Linux are not listed as affected. This flaw is a second-stage technique in a multi-vulnerability chain - not a standalone entry point - and no public exploit code or CISA KEV listing has been identified, placing real-world exploitation risk substantially below what the C:H confidentiality impact alone might imply.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is an open-source library embedded in Chrome that translates OpenGL ES API calls into platform-native graphics APIs (Metal on macOS, DirectX on Windows). CWE-125 (Out-of-Bounds Read) indicates that ANGLE fails to enforce proper buffer boundary checks during processing of GPU-related data, likely triggered by malformed shader instructions, texture descriptors, or draw commands embedded in a crafted HTML page. The out-of-bounds read allows the attacker to read memory beyond the intended buffer, potentially exposing adjacent heap or stack contents from the renderer process. The flaw is macOS-specific, suggesting the vulnerable code path may rely on a Mac-only ANGLE backend or driver interaction. Affected product scope per EUVD-2026-40663: Google Chrome on Mac, all versions below 150.0.7871.47.
RemediationAI
Update Google Chrome on macOS to version 150.0.7871.47 or later via the stable channel release documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism handles this for most consumer installations; enterprise administrators should verify enforcement of the update through fleet management tools or Chrome browser cloud management policies. Because this vulnerability requires a pre-compromised renderer as a prerequisite, organizations should additionally prioritize patching any Chrome renderer escape vulnerabilities (typically rated High or Critical) to deny the first-stage access that makes CVE-2026-13975 exploitable at all. Compensating controls prior to patching include enforcing web content filtering to restrict access to untrusted or unknown sites (reducing exposure to renderer exploits generally), and deploying Chrome in Site Isolation mode if not already active - this limits the data accessible within any single renderer process, reducing the value of a memory disclosure even if exploitation is achieved. Note that Site Isolation is enabled by default in modern Chrome versions and does not require additional configuration changes.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today