EUVD-2026-41192
GHSA-rxxj-fpv4-4vvw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page (AV:N), no attacker auth needed (PR:N), user must visit page (UI:R), and only confidentiality is impacted (C:H) with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Dawn in Google Chrome on ChromeOS prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory use in Dawn, Chrome's WebGPU implementation, on ChromeOS prior to version 150.0.7871.46 enables remote attackers to read potentially sensitive contents from GPU process memory by serving a crafted HTML page. The flaw (CWE-457) allows stale or uninitialized buffer data to be exposed back to the requesting JavaScript context without proper sanitization. No public exploit has been identified at time of analysis, and CISA SSVC rates this as non-automatable with partial technical impact, though the CVSS confidentiality rating is High.
Technical ContextAI
Dawn is Google's open-source WebGPU implementation used by Chromium on ChromeOS to interface with the GPU. CWE-457 (Use of Uninitialized Variable) describes a class of memory safety flaw where allocated memory buffers are read before being explicitly initialized or zeroed, causing leftover data from prior allocations - potentially containing cryptographic material, session tokens, or other sensitive in-process data - to be returned to the caller. In the browser threat model, WebGPU API calls from a rendered HTML page can trigger Dawn code paths that read uninitialized GPU-side or shared-memory buffers and surface their contents to JavaScript. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to ChromeOS; the EUVD entry EUVD-2026-41192 confirms all Chrome versions below 150.0.7871.46 on ChromeOS fall within the vulnerable range.
RemediationAI
Update Google Chrome on ChromeOS to version 150.0.7871.46 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. ChromeOS devices typically receive updates automatically; administrators managing enterprise or education fleets should verify update delivery via the Google Admin console under Device Management and enforce auto-update policies for Chrome browser and OS. No bypass or workaround addresses the underlying uninitialized memory condition in Dawn without the vendor patch. As a compensating control prior to patching, restricting navigation to untrusted or external websites on affected ChromeOS devices via Chrome Browser Cloud Management URL filtering can reduce exposure, though this comes at the cost of general browsing capability and does not eliminate risk from compromised trusted sites.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today