What is the CVSS score of CVE-2026-18001?

CVE-2026-18001 has a contested CVSS base score of 6.5 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-18001?

Yes, a patch is available for CVE-2026-18001. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-18001

EUVD-2026-50927 MEDIUM

Information Exposure (CWE-200)

2026-07-30 Chrome

GHSA-j7jv-4f3j-j984

Information Disclosure Google

Medium

Disputed · 6.5 Vendor: Chrome

Severity by source

Sources disagree (Low–Critical)

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted page, no privileges needed, user must visit page (UI:R); only confidentiality impacted as the flaw yields a memory read with no write or crash primitive.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

3.1 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:33 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:26 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:26 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.

Technical ContextAI

WebGL (Web Graphics Library) is a browser-embedded JavaScript API exposing OpenGL ES 2.0/3.0 GPU functionality directly to web pages without plugins. Chrome's implementation routes WebGL calls through the GPU process sandbox. The flaw is classified as an 'inappropriate implementation' - meaning Chrome's logic around WebGL state management or memory handling violates expected security invariants, allowing cross-boundary reads of process memory that should be inaccessible to the rendering context. No CWE is formally assigned, but the behaviour aligns with CWE-125 (Out-of-bounds Read) or CWE-200 (Exposure of Sensitive Information) patterns common in graphics-driver bridging code. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.

RemediationAI

Update Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Help > About Google Chrome) or through enterprise software distribution. The patch is confirmed available per the Chrome stable channel release blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organisations that cannot immediately update, a compensating control is to disable WebGL via enterprise policy (ChromeWebGLEnabled = false or WebGLEnabled policy set to disabled); note this will break WebGL-dependent web applications and may affect productivity for users of CAD, mapping, or 3D visualisation tools. Alternatively, restricting navigation to untrusted external sites via URL filtering reduces exposure. Enterprise administrators should prioritise rollout within the normal patch cycle rather than treating this as a break-glass event given the low EPSS and absence of active exploitation.