EUVD-2026-33206
GHSA-3px4-28qc-4f47
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds memory read via integer overflow in Chrome's ANGLE graphics layer exposes limited memory contents to remote attackers who can lure victims to a malicious page. Affected are all Google Chrome versions prior to 148.0.7778.216 on desktop platforms. The vulnerability carries a CVSS score of 4.3 (Medium) with a confidentiality-only impact; no public exploit code exists and no active exploitation has been confirmed, with EPSS at 0.03% (11th percentile), placing real-world risk at low-to-moderate despite the network-accessible attack vector.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction library that translates OpenGL ES API calls to platform-native APIs such as DirectX (Windows), Metal (macOS), and Vulkan. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 148.0.7778.216. The root cause is an integer overflow in ANGLE's internal arithmetic - when processing attacker-controlled values from a crafted HTML page (likely via WebGL or Canvas rendering paths), an integer computation overflows, producing an incorrect buffer size or offset that causes a subsequent read to exceed valid memory boundaries, resulting in an out-of-bounds memory read. It is worth flagging that the assigned CWE is CWE-472 ('External Control of Assumed-Immutable Web Parameter'), which is inconsistent with the described integer overflow and OOB read primitive; the vulnerability more accurately maps to CWE-190 (Integer Overflow) chained with CWE-125 (Out-of-Bounds Read). This discrepancy should be treated as a data quality issue in the NVD/EUVD entry.
RemediationAI
The vendor-released patch is Google Chrome version 148.0.7778.216, available via the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Users and administrators should update Chrome to 148.0.7778.216 or later using Chrome's built-in update mechanism (Settings → About Chrome) or via enterprise deployment tooling. No workaround is documented by the vendor. If immediate patching is not feasible in enterprise environments, a compensating control is to restrict access to untrusted or external web content through proxy filtering or browser isolation solutions, noting this adds operational friction and does not eliminate the vulnerability for internally hosted malicious content. Chromium-derived browsers should be checked against their own advisory feeds for equivalent fixes.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today