EUVD-2026-50809
GHSA-3wgm-hxjc-v3w2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML/WebGL page
-
DeliveryVictim clicks link and opens page in Chrome < 151.0.7922.72
-
ExploitCrafted content triggers ANGLE graphics implementation flaw
-
ExecutionRenderer process memory contents leaked to attacker-controlled script
-
ImpactSensitive in-process data (tokens, page content) exfiltrated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be running Google Chrome in any version prior to 151.0.7922.72 on a supported desktop platform (Windows, macOS, or Linux). The victim must actively navigate to or be redirected to an attacker-controlled HTML page - CVSS UI:R confirms that exploitation cannot occur without this user interaction; passive network-level exploitation is not possible. CVSS PR:N confirms no authentication to any target system is required of the attacker. No special Chrome feature, flag, or non-default configuration is required; default Chrome installations are in scope. Exploitation is constrained to the renderer process (S:U, no scope change), so data accessible is limited to what resides in that process - not the full OS memory space. No integrity or availability impact is possible via this flaw alone. |
| Impact | The CVSS 3.1 base score of 6.5 is driven by AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact, tempered by a mandatory user interaction requirement and no scope change. The C:H rating indicates the potential for meaningful in-memory data exposure (e.g., tokens, cached credentials, page content) within the Chrome renderer process. However, real-world prioritization signals are mixed: EPSS of 0.29% at the 21st percentile indicates the vulnerability is not currently being targeted at scale; it is not listed in the CISA KEV catalog; and no POC is publicly known. The UI:R constraint meaningfully reduces the attack surface compared to drive-by vectors. Overall risk is moderate: the attack is straightforward if a user can be socially engineered to visit a malicious page, but active exploitation campaigns have not materialized. Organizations with elevated threat profiles (targets of surveillance tooling or nation-state actors) should treat this as higher priority than the EPSS alone suggests. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing JavaScript or WebGL content that triggers the ANGLE implementation flaw during graphics processing. A victim using Chrome prior to 151.0.7922.72 is lured to the page - via phishing email, malicious advertisement, or compromised third-party site - causing the browser's ANGLE subsystem to leak renderer process memory contents back to the attacker's page. No public POC is known at time of analysis, but the low attack complexity (AC:L) suggests the technique is not inherently difficult to develop for a capable attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, per the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates automatically, but users must fully restart the browser after the update is downloaded for it to take effect - verify the installed version under chrome://settings/help. For environments where immediate restart is not feasible, restrict navigation to untrusted or external websites as a temporary compensating control; this reduces exposure but does not eliminate it if trusted sites are compromised. Enterprise deployments using Chrome via managed policies should push the update through their endpoint management platform and enforce browser restart via policy to close the remediation gap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction layer that translates OpenGL ES API calls to platform-native rendering APIs (DirectX on Windows, Metal on macOS, Vulkan where supported). An inappropriate implementation within ANGLE - classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - causes the subsystem to improperly handle memory in a way that allows contents of the renderer process to be read by attacker-controlled web content. The vulnerability is scoped to the renderer process (S:U in CVSS, no sandbox escape), limiting but not eliminating the sensitivity of potentially disclosed data. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N and PR:N because only a crafted web page visit is required; UI:R for mandatory victim navigation; C:H for renderer process memory exposure; S:U confirms no sandbox escape; I:N and A:N as no write or denial-of-service impact exists.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB