EUVD-2026-33077
GHSA-m37r-5c69-pv9v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics layer affects all versions prior to 148.0.7778.216, enabling remote unauthenticated attackers (PR:N) to read cross-process memory contents via a crafted HTML page. The root cause is an uninitialized variable (CWE-457) in ANGLE - Chrome's OpenGL ES abstraction layer - where stale memory contents can be read and exfiltrated across security origins. No public exploit code has been identified at time of analysis and the EPSS score of 0.03% (11th percentile) indicates very low current exploitation probability; however, the low attack complexity (AC:L) and zero privilege requirement make opportunistic targeting feasible once exploitation techniques mature.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google's cross-platform translation layer that maps OpenGL ES calls to platform-native graphics APIs (DirectX on Windows, Metal on macOS, Vulkan on supported platforms). CWE-457 (Use of Uninitialized Variable) describes a class of memory safety flaw where allocated memory is consumed before being explicitly zeroed or assigned, exposing residual contents from prior allocations or other processes. In the context of a browser renderer, uninitialized GPU-adjacent memory may contain fragments of previously rendered content from other origins, violating the Same-Origin Policy at the graphics pipeline level. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome stable builds across platforms prior to the 148.0.7778.216 stable channel release.
RemediationAI
The primary fix is to update Google Chrome to version 148.0.7778.216 or later; this is the vendor-confirmed patched release as documented in the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's auto-update mechanism will deliver this patch to most desktop users automatically - administrators should verify fleet update status via their endpoint management tooling. For environments where immediate patching is not feasible, the most effective compensating control is to restrict user navigation to untrusted or externally-hosted web content using browser isolation solutions or allowlist-based URL filtering, which limits exposure to crafted attacker-controlled pages. Disabling hardware-accelerated graphics (chrome://settings → System → 'Use hardware acceleration when available') would bypass ANGLE processing but carries significant performance trade-offs and is not recommended as a long-term control. Organizations managing Chromium-derived browsers should monitor each vendor's independent advisory channel for their respective patch releases.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today