EUVD-2026-65984
GHSA-4px6-5f3c-ghgv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page, no prior privileges needed, victim interaction required; impact limited to partial cross-origin read with no integrity or availability consequences.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim be running Google Chrome prior to version 152.0.7977.65 on any supported desktop platform, and must actively visit a crafted HTML page controlled by the attacker - passive network exposure alone is not sufficient (CVSS UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but mandating user interaction (UI:R), with unchanged scope (S:U) and only partial confidentiality impact (C:L, I:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page containing crafted HTML and graphics workload designed to trigger an uninitialized resource read within Chrome's ANGLE layer. When a victim using Chrome prior to 152.0.7977.65 navigates to this page, the browser processes the graphics content, and ANGLE reads uninitialized memory that may contain residual data from a different web origin, potentially disclosing cross-origin content to the attacker's script. … |
| Remediation | Update Google Chrome to version 152.0.7977.65 or later via the browser's built-in update mechanism (Settings → Help → About Google Chrome) or through enterprise software management tooling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today