EUVD-2026-44477
GHSA-25xw-cf43-5ccv
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted HTML page requires active user navigation (UI:R, PR:N); impact is confidentiality-only with no code execution or availability effect (I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized variable use in Google Chrome's V8 JavaScript engine (all versions prior to 150.0.7871.125) exposes potentially sensitive process memory contents to remote attackers who can induce a user to visit a crafted HTML page. The confidentiality impact is rated high under CVSS, as uninitialized heap or stack memory in V8 may contain residual data such as session tokens or cached credentials from the browser process. No public exploit code exists and no active exploitation has been identified - EPSS sits at 0.33% (25th percentile) and SSVC rates exploitation as none - but a vendor patch is confirmed available in Chrome 150.0.7871.125.
Technical ContextAI
V8 is Google's open-source, high-performance JavaScript and WebAssembly engine embedded in Chrome and Chromium-derived products. CWE-457 (Use of Uninitialized Variable) describes a class of flaw where a memory location is accessed before being assigned a defined value, causing the runtime to read whatever residual bytes occupy that region - potentially data from prior allocations, freed objects, or JIT compilation artifacts. In V8's context, uninitialized reads can arise during optimized code generation, garbage collection transitions, or object property access paths. The affected scope is all Google Chrome versions matching CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* prior to 150.0.7871.125, as confirmed by EUVD-2026-44477. The vulnerability was assigned Chromium security severity High and reported through Chrome's internal security process.
RemediationAI
Update Google Chrome to version 150.0.7871.125 or later, which contains the fix as documented in the Chrome stable channel release at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0353146366.html. Chrome's built-in auto-update mechanism will deliver this patch automatically for most users; administrators can verify the installed version by navigating to chrome://settings/help and triggering a manual update check. ChromeOS administrators should apply the ChromeOS-specific stable channel update referenced at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-chromeos_01375142362.html. In environments where immediate patching is constrained, a compensating control is to enforce web content filtering at the network perimeter to block access to untrusted or uncategorized sites, reducing the likelihood a user reaches attacker-controlled pages - though this does not eliminate exposure for trusted-but-compromised sites and introduces browsing friction.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today