Monthly
Skia, the 2D graphics rendering library embedded in Google Chrome's renderer process, contains an uninitialized resource flaw that allows remote attackers to read stale sandbox memory contents by inducing a victim to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms, with confidentiality impact confined to the renderer sandbox. The EPSS score of 0.19% (9th percentile) and absence from CISA KEV reflect low observed exploitation pressure, though such memory-read primitives are classically useful as components in multi-stage exploit chains targeting browser memory.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Skia, the 2D graphics rendering library embedded in Google Chrome's renderer process, contains an uninitialized resource flaw that allows remote attackers to read stale sandbox memory contents by inducing a victim to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms, with confidentiality impact confined to the renderer sandbox. The EPSS score of 0.19% (9th percentile) and absence from CISA KEV reflect low observed exploitation pressure, though such memory-read primitives are classically useful as components in multi-stage exploit chains targeting browser memory.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.