EUVD-2026-33086
GHSA-h44x-g8cv-p3qx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized use (CWE-457) in ANGLE, Chrome's graphics abstraction layer, exposes cross-origin data to attackers who have already compromised the renderer process in Google Chrome prior to 148.0.7778.216. Exploitation requires delivering a crafted HTML page to a victim who interacts with it, making this a post-compromise data exfiltration primitive rather than an initial access vector. The CVSS score of 3.1 and EPSS of 0.03% (11th percentile) are consistent with the constrained prerequisites; no public exploit code exists and no active exploitation has been confirmed.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics translation library that maps OpenGL ES calls to platform-native APIs such as DirectX (Windows), Metal (macOS), and Vulkan. CWE-457 (Use of Uninitialized Variable) describes a class of bugs where allocated memory is read before being initialized, potentially exposing residual contents from prior allocations. In this case, the uninitialized state within ANGLE's rendering pipeline can be observed by a compromised renderer process, leaking data that may include cross-origin content from adjacent memory regions. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD-2026-33086 confirm all Chrome desktop versions prior to 148.0.7778.216 are in scope, with no platform differentiation indicated in available data.
RemediationAI
The vendor-released patch is Google Chrome 148.0.7778.216, confirmed by the official Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Users should verify their installed version via chrome://settings/help and allow Chrome's auto-update mechanism to apply the fix, or manually trigger an update. Because this vulnerability requires a pre-existing renderer compromise, organizations that have already enabled Chrome's Site Isolation feature gain meaningful defense-in-depth by limiting renderer access to cross-origin data; this can be verified at chrome://process-internals. No functional workaround exists that addresses the uninitialized memory condition itself without upgrading, as it resides in a core graphics rendering path used across all content types.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today