Google Chrome CVE-2026-7942

The vulnerability requires the victim to visit or be redirected to an attacker-controlled webpage containing crafted WebGL rendering commands or Canvas drawing operations. The vulnerability is specific to systems with GPU acceleration enabled (default configuration in Chrome). No authentication is required-an unauthenticated remote attacker can host the malicious page. The attacker benefits from the victim having sensitive pages open in other Chrome tabs or windows; exploitation is not detectable to the user as it does not crash the browser or display visual artifacts. Exploitation is limited to information disclosure (C:L in CVSS)-the attacker cannot modify data or achieve remote code execution. The integer overflow must be triggered within ANGLE's GPU memory allocation or index validation logic, suggesting the vulnerability exists only in specific rendering code paths, not all WebGL usage.

This vulnerability presents moderate real-world risk despite a low CVSS score of 4.3. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) indicates network-accessible, low-complexity exploitation requiring only user interaction and resulting in limited confidentiality impact-appropriate for a data leak without integrity or availability impact. However, cross-origin data leakage violates fundamental browser security boundaries, making it strategically significant even if the CVSS scope is unchanged (S:U). The 'Medium' Chromium severity rating suggests Google's internal risk assessment aligns with moderate concern. No KEV status, EPSS score, or POC availability is provided in the input, limiting exploitation probability assessment. The requirement for user interaction (visiting a malicious site) and the narrow scope (information disclosure only) reduce likelihood of widespread automated exploitation compared to network-based RCE vulnerabilities. Risk is highest for targeted spear-phishing or watering hole attacks where an attacker crafts a page to steal authentication tokens or session data from other tabs.

An attacker creates a malicious website hosting crafted WebGL shader code or Canvas rendering commands that trigger the ANGLE integer overflow. When a victim visits the site in Chrome (while logged into Gmail, banking portal, etc.), the exploit executes in the renderer process, causing memory calculations in ANGLE to overflow. The out-of-bounds GPU memory read leaks authentication tokens, session cookies, or sensitive page content from other open browser tabs or windows, which the attacker exfiltrates via JavaScript to their server.