EUVD-2026-50840
GHSA-998q-hx29-hhcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML/WebGL page
-
DeliveryLure user to visit page (social engineering or redirect)
-
ExploitTrigger uninitialized ANGLE memory read in renderer
-
ExecutionCapture leaked process memory contents via script
-
ImpactExfiltrate sensitive data to attacker-controlled server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation unconditionally requires a user to actively navigate to or be redirected to a crafted HTML page - the CVSS UI:R metric confirms this user interaction is mandatory and non-bypassable. No authentication, special server configuration, or non-default browser settings are required; any default Chrome installation prior to 151.0.7922.72 on any platform is vulnerable. Per SSVC, the attack is not automatable, ruling out drive-by mass exploitation without deliberate user action. The key limiting factor is scope: the attacker can only read memory within the Chrome renderer process, and the exact sensitivity of leaked data depends on what residual content occupies uninitialized memory regions at exploitation time, which is non-deterministic. Exploitation cannot achieve code execution, integrity modification, or denial of service based on current data (I:N, A:N in CVSS). |
| Impact | CVSS 3.1 scores this at 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - network-reachable, low complexity, no privileges required, but user interaction mandatory. The C:H rating implies potentially high confidentiality impact from memory leakage, which is the most alarming signal. However, multiple other signals significantly temper this: EPSS at 0.31% (24th percentile) reflects low observed exploitation probability across the threat intelligence ecosystem; SSVC rates exploitation as none and technical impact as partial, suggesting the realistic data recoverable may be limited; and the SSVC Automatable:no rating aligns with UI:R, precluding worm-like or mass-automated exploitation campaigns. There is a tension between CVSS's C:H and SSVC's partial technical impact - this likely reflects uncertainty about what sensitive in-memory data is actually recoverable versus theoretically accessible. Overall, this is a meaningful information-disclosure flaw in a ubiquitous browser that warrants prompt patching, but is not an emergency zero-day scenario given the absence of active exploitation and low EPSS. |
| Exploit ScenarioDerived | An attacker hosts a webpage containing crafted WebGL or GPU-accelerated rendering content designed to trigger specific uninitialized memory paths within Chrome's ANGLE graphics layer. When a targeted user visits the page using a vulnerable Chrome version, the browser processes the malicious graphics operations and exposes fragments of process memory - potentially including session tokens, cached credentials, or other in-memory data - accessible to attacker-controlled JavaScript. No public exploit code has been identified at time of analysis, and successful exploitation requires user navigation to the malicious page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch as confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically updates automatically, but administrators managing enterprise fleets should verify deployment via Group Policy or MDM tooling and confirm the installed version is 151.0.7922.72 or higher. As a compensating control prior to patching for high-risk users (e.g., executives, privileged accounts), enforcing browser isolation or restricting access to untrusted external web content through a secure web gateway can reduce exposure, at the cost of limiting general browsing functionality. Disabling WebGL or hardware-accelerated graphics via Chrome flags (--disable-gpu, --use-gl=swiftshader) may also reduce ANGLE attack surface but will degrade rendering performance noticeably.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform OpenGL ES translation layer, converting graphics API calls to platform-native backends such as Direct3D (Windows), Metal (macOS), and Vulkan. CWE-457 (Use of Uninitialized Variable) arises when memory is allocated but not zeroed or initialized before use, potentially exposing residual data from prior memory allocations or heap contents. In this case, a crafted HTML page can trigger specific graphics operations through ANGLE that access uninitialized memory regions, causing those contents to be accessible to attacker-controlled script. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome versions across all platforms are affected prior to the patched release, as catalogued under EUVD-2026-50840.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted HTML page with mandatory active user navigation (UI:R); memory leakage justifies C:H with no integrity or availability impact whatsoever.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB