EUVD-2026-41194
GHSA-pgvf-397w-wh5f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML (AV:N), no special conditions (AC:L), no attacker privileges (PR:N), user must visit page (UI:R), confidentiality-only impact with no scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory use in Dawn, Chrome's WebGPU graphics subsystem, exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.46. The flaw is classified CWE-457 and carries a CVSS 3.1 score of 6.5 with high confidentiality impact; however, real-world exploitation risk is tempered by the requirement for user interaction, a very low EPSS of 0.20% (10th percentile), and SSVC assessment of no current exploitation. No public exploit identified at time of analysis; vendor-released patch is available in Chrome 150.0.7871.46.
Technical ContextAI
Dawn is Google's open-source, cross-platform implementation of the WebGPU and WebGL graphics APIs embedded in Chromium. CWE-457 (Use of Uninitialized Variable) occurs when a variable is read before a defined value is written to it, meaning the read returns whatever bytes happened to occupy that memory region - in a browser renderer process, these stale bytes may include fragments of JavaScript heap data, decoded media, cached network content, or other in-process sensitive material. WebGPU processing paths in Dawn involve GPU command buffer construction and shader compilation pipelines that are inherently complex and allocation-heavy, creating multiple opportunities for uninitialized reads if allocation paths branch unexpectedly. The affected product as identified by CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the version boundary set at Chrome 150.0.7871.46.
RemediationAI
Update Google Chrome to version 150.0.7871.46 or later, which is confirmed as the vendor-released patch per the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism should deliver this automatically; administrators managing enterprise fleets should verify deployment via policy or endpoint management tooling. For Linux distributions shipping Chromium independently (e.g., openSUSE, noted in the tags), apply the distribution's patched Chromium package once available through official channels. If immediate patching is not feasible, a compensating control is to disable or restrict access to sites that leverage WebGPU (chrome://flags/#enable-unsafe-webgpu can be used to disable the API), though this will break legitimate WebGPU content and carries usability trade-offs. Enforcing Chrome Site Isolation (already default in modern Chrome) limits the scope of any disclosed memory to the renderer process of the attacker-controlled origin.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today