EUVD-2026-33077
GHSA-m37r-5c69-pv9v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics layer affects all versions prior to 148.0.7778.216, enabling remote unauthenticated attackers (PR:N) to read cross-process memory contents via a crafted HTML page. The root cause is an uninitialized variable (CWE-457) in ANGLE - Chrome's OpenGL ES abstraction layer - where stale memory contents can be read and exfiltrated across security origins. No public exploit code has been identified at time of analysis and the EPSS score of 0.03% (11th percentile) indicates very low current exploitation probability; however, the low attack complexity (AC:L) and zero privilege requirement make opportunistic targeting feasible once exploitation techniques mature.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google's cross-platform translation layer that maps OpenGL ES calls to platform-native graphics APIs (DirectX on Windows, Metal on macOS, Vulkan on supported platforms). CWE-457 (Use of Uninitialized Variable) describes a class of memory safety flaw where allocated memory is consumed before being explicitly zeroed or assigned, exposing residual contents from prior allocations or other processes. In the context of a browser renderer, uninitialized GPU-adjacent memory may contain fragments of previously rendered content from other origins, violating the Same-Origin Policy at the graphics pipeline level. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome stable builds across platforms prior to the 148.0.7778.216 stable channel release.
RemediationAI
The primary fix is to update Google Chrome to version 148.0.7778.216 or later; this is the vendor-confirmed patched release as documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's auto-update mechanism will deliver this patch to most desktop users automatically - administrators should verify fleet update status via their endpoint management tooling. For environments where immediate patching is not feasible, the most effective compensating control is to restrict user navigation to untrusted or externally-hosted web content using browser isolation solutions or allowlist-based URL filtering, which limits exposure to crafted attacker-controlled pages. Disabling hardware-accelerated graphics (chrome://settings → System → 'Use hardware acceleration when available') would bypass ANGLE processing but carries significant performance trade-offs and is not recommended as a long-term control. Organizations managing Chromium-derived browsers should monitor each vendor's independent advisory channel for their respective patch releases.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today