EUVD-2026-40698
GHSA-m6w7-672m-rg27
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via HTML page (AV:N), no special conditions (AC:L), no authentication needed (PR:N), victim must visit attacker page (UI:R), information disclosure only with no integrity or availability impact (C:H/I:N/A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory use in Chrome's codec subsystem on Windows leaks process memory contents to remote attackers who can direct a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 on Windows are affected; exploitation requires no authentication but does require the victim to visit attacker-controlled content, placing this in the drive-by browsing threat category. No public exploit code has been identified at time of analysis, and Google has released a confirmed fix in stable channel 150.0.7871.47.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a class of memory safety flaw where a variable or buffer is allocated but not zeroed or otherwise initialized before being read. In Chrome's codec subsystem - the component responsible for decoding audio and video media content embedded in or referenced by HTML pages - a code path on Windows fails to initialize memory before using it. Because uninitialized heap or stack memory can contain residual data from prior allocations within the same process (including credentials, tokens, or other sensitive values previously handled by the renderer), reading and returning that data to a remote attacker constitutes an information disclosure. The Windows-platform specificity suggests a platform-conditional codec code path or a Windows-specific allocator behavior that does not zero memory. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms the attack is network-delivered, low-complexity, and does not escape the browser sandbox (no scope change), which is consistent with a renderer-level memory leak rather than a full sandbox escape.
RemediationAI
The primary remediation is to update Google Chrome on Windows to version 150.0.7871.47 or later, confirmed available via the vendor's stable channel release at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this patch to most users automatically; administrators managing enterprise deployments via Google Admin Console or third-party patch management should verify rollout completion. If immediate patching is not feasible, organizations can reduce exposure by enforcing web content filtering to block access to untrusted external sites from vulnerable Windows Chrome instances, though this impairs normal browsing functionality. Restricting users to known-safe intranet resources is a partial compensating control with significant usability trade-offs. There is no configuration flag to disable the vulnerable codec path without disabling media playback entirely.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today