EUVD-2026-41189
GHSA-8353-c32h-g49g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Web-delivered attack needs no privileges but requires victim navigation (UI:R, PR:N); memory-only disclosure with no write or crash impact (C:H/I:N/A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory read in ANGLE - Chrome's graphics abstraction layer - exposes potentially sensitive process memory to remote attackers on Windows systems running Chrome prior to 150.0.7871.46. Exploitation requires the victim to visit a crafted HTML page, after which the ANGLE Direct3D translation path leaks heap or stack contents that may include session tokens, cached credentials, or other browser-resident data. No active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.20% at the 10th percentile reflects very low current exploitation activity despite the CVSS C:H rating.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's portability layer that translates OpenGL ES graphics calls into platform-native APIs - specifically Direct3D 9/11 on Windows. CWE-457 (Use of Uninitialized Variable) describes a condition where a memory buffer is allocated but its contents are not zeroed or otherwise initialized before being accessed or transmitted, allowing residual data from prior allocations to be observed by an attacker. On Windows, ANGLE's Direct3D path is the active translation backend, making this code path Windows-specific and explaining the platform scoping in the description. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions across all platforms, but the vulnerability is explicitly scoped to Windows in the CVE description due to the platform-dependent ANGLE backend in use.
RemediationAI
Update Google Chrome on Windows to version 150.0.7871.46 or later, which contains the vendor-released patch resolving the uninitialized memory use in ANGLE; the Chrome Stable Channel advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Enterprise deployments that cannot patch immediately should enforce Chrome browser management policies to restrict navigation to allowlisted domains via Chrome Enterprise's URL blocklist feature - this reduces the attack surface since exploitation requires visiting an attacker-controlled page, though it trades usability for protection and does not eliminate risk from compromised trusted sites. Disabling WebGL via Chrome flags (--disable-webgl) may reduce the graphics attack surface through ANGLE at the cost of breaking web applications that rely on hardware-accelerated graphics. Auto-update should be verified as enabled for all managed endpoints to ensure timely propagation of the fix.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today