EUVD-2026-41177
GHSA-mfww-59q4-m6q7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N), low complexity, no attacker privileges; user must visit page (UI:R); impact is confidentiality-only within browser process (C:H/I:N/A:N/S:U).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome on Windows prior to 150.0.7871.46 stems from an out-of-bounds read in ANGLE, the browser's graphics abstraction layer. Remote attackers can exploit this by serving a crafted HTML page to a Windows user, causing the ANGLE subsystem to read memory beyond its intended buffer boundary and exposing data belonging to a separate web origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates low exploitation probability in the near term.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's OpenGL ES translation layer, responsible for converting WebGL and canvas graphics calls into platform-native graphics APIs - on Windows this means Direct3D. CWE-125 (Out-of-bounds Read) indicates the vulnerability arises when ANGLE reads beyond a valid memory buffer boundary during processing of graphics operations triggered by a crafted HTML page, exposing adjacent memory contents to the rendering context. Because ANGLE operates across the renderer process's access to GPU-mapped memory, an out-of-bounds read can expose data from cross-origin frames sharing graphics resources. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions on all platforms per NVD, but the description and Chromium security advisory explicitly scope the exploitable path to the Windows platform where Direct3D translation introduces the vulnerable code path.
RemediationAI
Upgrade Google Chrome on Windows to version 150.0.7871.46 or later, which contains the vendor-released patch for this vulnerability. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will typically deliver this fix automatically; administrators managing enterprise deployments should confirm the update has been applied via policy or inventory tooling. If immediate upgrade is not feasible, disabling WebGL via Chrome enterprise policy (chrome://flags/#disable-webgl or the WebGL content setting) would reduce the ANGLE attack surface but may break web applications relying on hardware-accelerated graphics - assess compatibility impact before deploying. No other workaround is indicated by available advisory data.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today