EUVD-2026-50833
GHSA-34q9-m777-qwwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit separate Chrome renderer vulnerability
-
DeliveryAchieve renderer process code execution
-
ExploitDeliver crafted HTML page triggering uninitialized Media read
-
ExecutionAccess stale process memory contents
-
ImpactExfiltrate sensitive in-memory data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation strictly requires that the attacker has already compromised the Chrome renderer process via a separate, independent vulnerability - this is an explicit prerequisite stated in the CVE description. The renderer compromise is not trivially achieved and represents the primary barrier to exploitation. Beyond renderer compromise, the attacker needs the victim to interact with a crafted HTML page (UI:R in the CVSS vector). The vulnerability is limited to Google Chrome running on Windows; Chrome on macOS and Linux are not affected per the description. No special Chrome feature or non-default configuration is required once the renderer is compromised. What limits exploitation: the renderer compromise prerequisite is a high-complexity, multi-step requirement; exploitation is not automatable per SSVC; EPSS at 0.31% indicates no observed mass exploitation; and the flaw is disclosure-only with no integrity or availability impact. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 and rates attack complexity as Low, but this conflicts materially with the description's explicit prerequisite of prior renderer process compromise - a high-complexity, multi-step precondition that AC:L does not capture. Real-world exploitation requires chaining a separate renderer exploit with this information-disclosure primitive, substantially elevating the true attack complexity. EPSS at 0.31% (24th percentile) and SSVC exploitation status of 'none' align with this reduced practical risk. SSVC also rates automatable as 'no' and technical impact as 'partial,' reinforcing that this is a secondary-stage leak primitive rather than a standalone critical vulnerability. No KEV listing. The C:H metric is accurate for the impact if triggered, but the overall risk priority is lower than raw CVSS suggests due to the renderer-compromise dependency. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer vulnerability in Chrome on Windows to achieve code execution within the sandboxed renderer process. From that position, they cause the renderer to load a crafted HTML page that triggers the uninitialized Media component path, reading stale heap data into an accessible buffer. The leaked memory contents - potentially containing session tokens, credentials, or cryptographic keys from earlier allocations - are then exfiltrated back to the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
RemediationAI
Vendor-released patch: 151.0.7922.72. Update Google Chrome on Windows to version 151.0.7922.72 or later via Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or via enterprise deployment tooling. The full advisory with additional details is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control prior to patching, blocking renderer-compromise precursors - such as enforcing Chrome's Enhanced Protection mode in Safe Browsing and disabling the loading of untrusted or unvetted HTML content - reduces the precondition surface for chaining this flaw. Note that these controls do not eliminate the vulnerability but raise the bar for the required renderer compromise prerequisite.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-457 (Use of Uninitialized Variable) in Chrome's Media subsystem on Windows means memory allocated for media processing operations is used before being zeroed or populated with valid data. On Windows, heap allocators may reuse prior allocations containing leftover sensitive data from other process operations. The vulnerability is Windows-specific, suggesting it may be tied to platform-specific memory management behavior or a Windows-only Media API code path. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the description explicitly scopes impact to the Windows platform. The renderer process in Chrome is sandboxed, but a compromised renderer can still read its own process memory - including media pipeline buffers where uninitialized data resides.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Renderer compromise prerequisite elevates AC to H; network delivery with required user interaction; confidentiality-only impact with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB