Google Chrome
CVE-2026-7340
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted HTML (AV:N/AC:L/PR:N), requires user to visit page (UI:R), impact limited to partial memory read with no write or crash capability (C:L/I:N/A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds memory read in Google Chrome's ANGLE graphics layer on Windows exposes partial process memory to remote attackers through a crafted HTML page. Affected versions are all Chrome releases prior to 147.0.7727.138 on Windows; the ANGLE subsystem's integer overflow is the root cause. No public exploit code exists and no active exploitation is confirmed; EPSS at 0.01% and SSVC exploitation status of 'none' place this firmly in the low-urgency tier despite its network reachability.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction library that translates OpenGL ES API calls to native graphics backends - primarily Direct3D on Windows. The vulnerability arises from an integer overflow within ANGLE's processing logic, which corrupts memory offset calculations and causes a subsequent out-of-bounds read. The assigned CWE-472 ('External Control of Assumed-Immutable Web Parameter') is inconsistent with the described integer overflow mechanism; the actual root cause class aligns with CWE-190 (Integer Overflow or Wraparound) leading to CWE-125 (Out-of-bounds Read). This appears to be a NVD data-entry discrepancy defenders should note when mapping to control frameworks. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to Windows. Because ANGLE is a Windows-specific rendering path in Chrome, non-Windows platforms are not affected by this specific instance.
RemediationAI
Update Google Chrome on Windows to version 147.0.7727.138 or later, the vendor-released patch documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html. Chrome's built-in auto-update mechanism will apply this fix automatically for most consumer installations; enterprise administrators should push the update through Chrome Browser Cloud Management or Group Policy to ensure fleet-wide coverage. Where immediate patching is blocked by change-control processes, the practical compensating control is to prevent user navigation to untrusted external web content via proxy filtering or DNS-layer blocking, though this substantially limits browser functionality. Disabling hardware-accelerated graphics via chrome://flags/#use-angle would remove the ANGLE attack surface but will degrade rendering performance significantly and is not recommended as a long-term measure. No feature toggle exists in standard Chrome builds to surgically disable the vulnerable ANGLE code path without broader impact.
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP6 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today