EUVD-2026-50739
GHSA-6496-4w7m-wvc3
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via any web page (AV:N), no special conditions (AC:L), no auth required (PR:N), user must visit page (UI:R), renderer-sandboxed partial memory disclosure only (C:L, I:N, A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the graphics translation layer embedded in Chromium that maps OpenGL ES calls to platform-native APIs - on Windows this means DirectX. CWE-457 (Use of Uninitialized Variable) describes a class of bug where a memory region is read before it has been explicitly written, causing the program to operate on whatever bytes happen to occupy that address at the time. In a sandboxed browser renderer, such uninitialized regions may contain residual data from prior heap or stack allocations, potentially including fragments of earlier page content, decoded media, or other renderer-process state. The CPE string (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) scoped to Windows and the Chromium severity label of Medium are consistent with a confidentiality-only impact that does not cross process or sandbox boundaries.
RemediationAI
The primary fix is to upgrade Google Chrome on Windows to version 151.0.7922.72 or later, as confirmed by the vendor advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should deliver this patch to most end-user systems automatically; administrators managing enterprise deployments should verify version compliance via policy or MDM. If immediate patching is not possible, a compensating control is to restrict user browsing to trusted allow-listed domains via browser policy or a web proxy, which reduces exposure to crafted HTML pages - note that this is operationally disruptive and does not eliminate risk from compromised trusted sites. Disabling hardware-accelerated graphics (chrome://settings/system → 'Use graphics acceleration when available') would likely prevent triggering the ANGLE code path, but will degrade rendering performance noticeably and is not a vendor-recommended mitigation.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today