EUVD-2026-40738
GHSA-wpp5-cx9w-2rcj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer compromise prerequisite; all other metrics unchanged as no auth is required and confidentiality impact is high.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Uninitialized memory exposure in Google Chrome's GamepadAPI allows an attacker who has already achieved renderer process compromise to read potentially sensitive contents from process memory by serving a crafted HTML page that triggers the flaw. Affected versions are all Chrome releases prior to 150.0.7871.47. While the CVSS base score is 6.5 with high confidentiality impact, Chromium's own severity rating is Low, reflecting the significant prerequisite of prior renderer compromise that dramatically constrains real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a class of memory-safety bug where a variable or buffer is read before being assigned a valid value, potentially exposing stale heap or stack contents to the caller. In this case, the vulnerability resides in Chrome's implementation of the Gamepad API - a W3C browser API that exposes connected gamepad and controller state to web content. The flaw appears to involve an uninitialized data structure within the GamepadAPI code path in the renderer process. Because browsers sandbox web content inside renderer processes, exploiting this flaw to read memory requires the attacker to already have code execution within that renderer sandbox - meaning the GamepadAPI bug functions as a post-exploitation information-disclosure primitive rather than an initial-access vector. The affected CPE covers Google Chrome desktop versions below 150.0.7871.47 across all platforms.
RemediationAI
Update Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released fix for this issue. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deliver this patch to most end users automatically; IT administrators managing enterprise deployments should verify rollout via policy or fleet management tooling. No workarounds are documented by the vendor, but the realistic exploitability of this flaw is constrained to environments where an attacker has already achieved renderer compromise - organizations should prioritize patching other high-severity renderer bugs that could serve as the prerequisite entry point for this information-disclosure step.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today