EUVD-2026-50815
GHSA-9pfc-5g23-v3x7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page with malicious graphics payload
-
DeliveryLure or redirect victim to page
-
ExploitTrigger ANGLE uninitialized memory read via WebGL/canvas API
-
ExecutionAccess stale cross-origin memory contents
-
ImpactExfiltrate leaked data to attacker-controlled endpoint
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | User interaction is mandatory - the victim must actively navigate to or be redirected to the attacker-controlled HTML page (UI:R per CVSS vector). No authentication, special browser configuration, or elevated privilege is required from the victim's side (PR:N). The vulnerable code path resides within Chrome's ANGLE graphics subsystem and is reachable via standard web content (likely WebGL or canvas APIs) without any non-default browser settings. Exploitation is strictly limited to cross-origin information disclosure; it does not enable code execution, browser sandbox escape, or modification of data (I:N, A:N, S:U). The attack is limited to desktop Chrome versions prior to 151.0.7922.72; mobile Chrome versions are not explicitly covered by the available CPE data. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity flaw requiring no privileges but mandatory user interaction (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The confidentiality impact is partial (C:L), with no integrity or availability dimensions. EPSS at 0.31% in the 24th percentile confirms the low current exploitation probability, consistent with the absence of a CISA KEV listing and no identified public POC. Scope is unchanged (S:U), confining impact to the renderer's privilege boundary and limiting the blast radius versus a full sandbox escape. Despite Chrome's ubiquitous deployment footprint, the combination of required user interaction, limited impact class (data leak only, no code execution), and a low EPSS score positions this as a genuine medium-priority patch-and-move-on issue rather than an emergency. No conflicting signals are present; the CVSS vector is internally consistent with the described cross-origin information disclosure scenario. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing JavaScript that triggers a specific ANGLE graphics code path - likely via WebGL draw calls or canvas operations - causing Chrome to read uninitialized memory within the graphics pipeline. When a victim visits the page, stale memory contents potentially belonging to a different web origin are exposed to the attacker's page context, enabling extraction of cross-origin data. No public POC has been identified at time of analysis, and successful exploitation requires convincing a user to navigate to the malicious page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; enterprise administrators should verify deployment via Chrome Browser Cloud Management or equivalent policy tooling and confirm version compliance across managed endpoints. No documented workarounds exist for this ANGLE-level flaw short of disabling WebGL (via the '--disable-webgl' flag or enterprise policy 'WebGLEnabled: false'), which prevents many sites from rendering correctly and should be treated as a disruptive last resort. The upstream Chromium issue is tracked at https://issues.chromium.org/issues/517045160. Chromium-derivative browser vendors should assess and apply equivalent upstream patches.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer embedded in Google Chrome that translates OpenGL ES API calls to platform-native graphics APIs such as Direct3D on Windows, Metal on macOS, and Vulkan. CWE-457 (Use of Uninitialized Variable) describes a class of memory safety bugs where allocated memory is read before being explicitly initialized, allowing residual or stale memory contents - potentially from adjacent or prior allocations - to be observed. In this case, uninitialized state within ANGLE's graphics pipeline is reachable via a crafted HTML page, likely through WebGL or canvas operations that invoke a code path where memory is not zeroed before use. This can expose memory contents belonging to a different web origin, breaking the Same-Origin Policy at the graphics subsystem level. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome variants prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AV:N for web-delivered attack, UI:R for mandatory victim navigation, C:L for bounded cross-origin data leak only; no integrity or availability impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB