EUVD-2026-33085
GHSA-pchx-cxc9-82h3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebGL implementation on Android affects all Chrome versions prior to 148.0.7778.216. The WebGL graphics subsystem performs an out-of-bounds read (CWE-125) when processing attacker-controlled content, exposing adjacent memory contents across origin boundaries to the initiating page. Remote unauthenticated attackers can trigger this condition by serving a crafted HTML page, but victim interaction is required - the user must visit the malicious page. No active exploitation is confirmed (not listed in CISA KEV), and EPSS of 0.03% (10th percentile) indicates low exploitation probability at time of analysis.
Technical ContextAI
WebGL (Web Graphics Library) is a JavaScript API that exposes GPU-accelerated 2D and 3D rendering directly in the browser sandbox. It interfaces with device GPU drivers, which historically have been a fertile attack surface. The root cause class here is CWE-125 (Out-of-bounds Read): the WebGL implementation reads memory beyond its allocated buffer boundary, which can expose adjacent in-process memory to the JavaScript caller. In a browser context, this translates to a Same-Origin Policy (SOP) bypass - the attacker's origin gains read access to memory that may contain data belonging to another origin loaded in the same process. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome versions up to the fix are implicated, with the Android platform specifically identified in the CVE description. Chrome internally classified this as High severity, reflecting the sensitivity of cross-origin data leakage as a browser security primitive violation even when the direct CVSS score is moderate.
RemediationAI
Update Google Chrome on Android to version 148.0.7778.216 or later, available immediately through the Google Play Store or Chrome's in-app update mechanism (Settings > About Chrome). The patch is confirmed available per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For organizations managing Android device fleets via MDM or EMM solutions, push the Chrome update as a forced policy update. If immediate patching is operationally blocked, disabling WebGL via Chrome enterprise policy (setting WebGLEnabled to false in managed configuration) eliminates the vulnerable code path entirely - note this will break any web application relying on WebGL-based rendering (3D maps, browser-based design tools, data visualizations). Given the user-interaction requirement and low EPSS score, this vulnerability does not warrant emergency out-of-band response for most organizations, but patch deployment within the standard monthly cycle is appropriate.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today