EUVD-2026-28047Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the renderer-compromise prerequisite; S:C captures cross-origin data access beyond the vulnerable GPU component's security boundary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's GPU process (versions prior to 148.0.7778.96) is exploitable by an attacker who has already compromised the renderer process, allowing them to read uninitialized GPU memory and exfiltrate data belonging to other web origins via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, substantially limiting real-world exploitation to multi-stage attack chains. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.03%, and CISA SSVC assesses exploitation as none at time of analysis.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes the root cause: GPU memory is read before being properly initialized, exposing stale contents from prior allocations that may belong to other web origins. Chrome's multi-process architecture isolates web content in sandboxed renderer processes, and GPU rendering occurs in a separate GPU process. Uninitialized memory in the GPU process can contain fragments from other origins' rendering operations, enabling a compromised renderer to exfiltrate cross-origin data. Affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 148.0.7778.96. The Red Hat and SUSE tags in the intelligence data indicate downstream Linux distributions that bundle Chrome or Chromium-based packages and may require separate package updates.
RemediationAI
The primary fix is to update Google Chrome to version 148.0.7778.96 or later, which was released in the stable channel as documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this patch on most systems; verify the installed version via chrome://settings/help. For Red Hat and SUSE environments, apply the corresponding Chromium package update via the distribution's package manager once vendor builds are published. No workarounds or compensating controls are documented, but given that exploitation requires an already-compromised renderer, defending against the renderer-level initial access (e.g., disabling JavaScript for untrusted sites, or using Chrome's Site Isolation feature, which is enabled by default) meaningfully disrupts the prerequisite stage of any attack chain.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today