EUVD-2026-50833
GHSA-34q9-m777-qwwq
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Renderer compromise prerequisite elevates AC to H; network delivery with required user interaction; confidentiality-only impact with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) in Chrome's Media subsystem on Windows means memory allocated for media processing operations is used before being zeroed or populated with valid data. On Windows, heap allocators may reuse prior allocations containing leftover sensitive data from other process operations. The vulnerability is Windows-specific, suggesting it may be tied to platform-specific memory management behavior or a Windows-only Media API code path. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions; the description explicitly scopes impact to the Windows platform. The renderer process in Chrome is sandboxed, but a compromised renderer can still read its own process memory - including media pipeline buffers where uninitialized data resides.
RemediationAI
Vendor-released patch: 151.0.7922.72. Update Google Chrome on Windows to version 151.0.7922.72 or later via Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or via enterprise deployment tooling. The full advisory with additional details is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control prior to patching, blocking renderer-compromise precursors - such as enforcing Chrome's Enhanced Protection mode in Safe Browsing and disabling the loading of untrusted or unvetted HTML content - reduces the precondition surface for chaining this flaw. Note that these controls do not eliminate the vulnerability but raise the bar for the required renderer compromise prerequisite.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today