EUVD-2026-41178
GHSA-q6j6-g24g-p9x4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML page (AV:N, AC:L), no attacker privileges needed (PR:N), victim must actively visit the page (UI:R), impact is confidentiality-only cross-origin data leak with no integrity or availability consequence (C:H/I:N/A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data exfiltration in Google Chrome's ANGLE graphics layer exposes sensitive browser memory contents to remote attackers who can induce a victim to visit a crafted HTML page. The out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction engine) affects all Chrome desktop versions prior to 150.0.7871.46, confirmed by Google's stable channel advisory. No public exploit code or active exploitation has been identified at time of analysis; an EPSS of 0.17% (7th percentile) reflects minimal current weaponization pressure despite the high confidentiality impact assigned in CVSS.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics translation library that converts OpenGL ES API calls into platform-native graphics APIs - DirectX on Windows, Metal on macOS, and Vulkan or OpenGL on Linux. CWE-125 (Out-of-Bounds Read) indicates that a crafted HTML page can trigger ANGLE to read memory beyond an allocated buffer boundary during graphics processing. In a browser context, this adjacent memory may contain data from other web origins rendered within the same process, enabling a cross-origin information leak. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome platform variants are in scope up to the patched release. The EUVD-2026-41178 entry corroborates the affected version range as all Chrome builds prior to 150.0.7871.46.
RemediationAI
Update Google Chrome to version 150.0.7871.46 or later, the vendor-confirmed patched release documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will deliver this patch automatically on most consumer installations; enterprise deployments using managed policies (Google Admin or GPO) should verify the rollout has completed across the fleet. For environments where immediate patching is not feasible, restricting end-user access to untrusted external web pages via web proxy or URL-category filtering reduces exposure, at the cost of general web browsing capability. Disabling WebGL via Chrome enterprise policy (--disable-webgl flag or WebGL policy) may reduce the ANGLE attack surface but will break WebGL-dependent applications and is not a confirmed targeted mitigation for this specific flaw. No workaround fully substitutes for patching.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today