EUVD-2026-41190
GHSA-3wpm-57w7-87qj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted webpage requires no attacker privileges; victim must actively load the page (UI:R); impact is limited to partial confidentiality loss with no integrity or availability consequence.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (all versions prior to 150.0.7871.46) enables remote attackers to read sensitive data from other browser origins by luring a victim to a crafted HTML page. The flaw stems from uninitialized memory use in ANGLE, Chrome's GPU abstraction layer, which may expose stale cross-origin pixel buffers or texture memory to attacker-controlled JavaScript. No public exploit has been identified and CISA's SSVC framework rates exploitation as none with a non-automatable attack path, indicating limited immediate real-world threat despite the network-accessible vector.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform OpenGL ES translation layer, converting graphics calls to platform-native APIs such as Direct3D (Windows), Metal (macOS), and Vulkan or OpenGL (Linux). CWE-457 (Use of Uninitialized Variable) identifies the root cause: a code path within ANGLE fails to initialize a variable or buffer prior to use, meaning the memory region retains stale content from prior GPU or CPU operations. In a browser context this is dangerous because those stale contents may include pixel data, texture buffers, or memory from a previously rendered cross-origin page, violating the Same-Origin Policy. The vulnerability is triggered through browser rendering of web content, as ANGLE is invoked whenever Chrome processes graphics - including WebGL and hardware-accelerated 2D canvas. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, confirming the scope is Chrome's application-layer code rather than an OS or third-party dependency.
RemediationAI
Update Google Chrome to version 150.0.7871.46 or later, which is the vendor-released patch for this vulnerability per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update will deliver the fix to most consumer endpoints automatically; enterprise administrators should verify deployment via Chrome Browser Cloud Management, Group Policy, or endpoint management tooling. If an immediate update is operationally blocked, disabling GPU hardware acceleration (chrome://settings → System → disable 'Use hardware acceleration when available') removes the ANGLE code path entirely and eliminates the vulnerable surface - however this carries a significant rendering performance cost and may break WebGL-dependent web applications. This workaround should be considered temporary only, with update as the definitive fix.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today