EUVD-2026-50794
GHSA-jmrw-c58m-5h7j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious WebGL
-
DeliveryLure victim via phishing or malicious ad
-
ExploitVictim loads page in vulnerable Chrome
-
ExecutionANGLE processes graphics call with uninitialized memory
-
PersistResidual cross-origin data exposed to attacker-controlled script
-
ImpactAttacker exfiltrates leaked data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | The victim must actively visit a crafted HTML page using a vulnerable version of Chrome (prior to 151.0.7922.72), making UI:R the primary limiting condition. No authentication to any service is required (PR:N), and no special browser configuration or feature flag needs to be enabled - Chrome's default rendering pipeline includes ANGLE. Exploitation is constrained by: (1) the need for user interaction to load the malicious page, (2) the SSVC determination that the attack is not automatable, and (3) exploitation requiring the attacker to construct a graphics operation that specifically triggers the uninitialized read path in ANGLE - a non-trivial technical requirement. The cross-origin data leakage is bounded by what is resident in the uninitialized memory at the time of the read; targeted, predictable data extraction is not guaranteed. |
| Impact | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a meaningful confidentiality risk: no privileges or special configuration needed, exploitable over the network, but requiring a user to visit a crafted page. The UI:R requirement is the key friction point - mass exploitation would require a phishing or drive-by delivery component. EPSS at 0.31% (24th percentile) is low, indicating limited observed exploitation interest across the broader threat landscape. SSVC corroborates this: Exploitation=none, Automatable=no, Technical Impact=partial. This vulnerability is not in CISA KEV. Taken together, the signals suggest a moderate-priority patch: genuinely exploitable for targeted information theft (e.g., stealing authentication tokens or session data from a co-rendered origin), but not imminently weaponized at scale. Organizations with high-risk user populations (executives, finance, legal) should prioritize patching sooner. |
| Exploit ScenarioDerived | An attacker registers or compromises a website and embeds crafted WebGL or canvas-rendering JavaScript that triggers ANGLE's uninitialized memory path. A victim is lured to the page via phishing or a malicious ad, and upon rendering, the browser leaks memory contents that may include data from a co-rendered cross-origin context - such as an authentication cookie value or token from a banking site open in another tab. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. The stable channel update announcement is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism will deliver this to most users automatically; administrators managing enterprise fleets should verify that update policies are not blocking the rollout. If patching is temporarily delayed, a compensating control is to enforce browser isolation policies (e.g., Site Isolation is already enabled by default in modern Chrome builds) and restrict access to untrusted web content via proxy filtering or managed browser profiles - though neither eliminates the underlying risk. Disabling WebGL via enterprise policy (RendererCodeIntegrity or WebGL disabled via flag) would reduce the attack surface at the cost of breaking graphics-heavy web applications.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics abstraction layer that translates OpenGL ES API calls into platform-native graphics APIs (Direct3D on Windows, Metal on macOS, Vulkan where supported). CWE-457 (Use of Uninitialized Variable) indicates that a memory region in ANGLE's processing pipeline is consumed before being fully initialized, meaning it may contain stale or residual data from prior allocations - potentially including data belonging to a different web origin. This class of bug in a graphics subsystem can enable speculative or direct cross-origin information disclosure through WebGL or canvas rendering operations. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page with no privileges; UI:R because victim must load the page; confidentiality-only impact, no integrity or availability loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB