EUVD-2026-33084
GHSA-56pj-6hm3-qpfx
Severity by source
Sources disagree (Low–High)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory use in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome versions prior to 148.0.7778.216 enables a remote attacker - who has already achieved renderer process compromise - to bypass site isolation via a specially crafted HTML page. This is a chained exploitation scenario: the vulnerability is not standalone, but serves as a second-stage primitive to break Chrome's cross-origin security boundary once an initial renderer foothold exists. No public exploit code has been identified at time of analysis, and the EPSS score of 0.01% (3rd percentile) reflects minimal observed exploitation activity.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is an open-source graphics translation library embedded in Google Chrome that converts OpenGL ES API calls to platform-native graphics APIs (DirectX, Vulkan, Metal, desktop OpenGL). CWE-457 (Use of Uninitialized Variable) describes a root-cause class where memory is read or used before it has been explicitly assigned a safe value, allowing the raw contents of previously allocated stack or heap memory to influence program behavior. In this context, the uninitialized state in ANGLE's graphics processing path can be manipulated by a renderer-level attacker to influence memory layout or logic in a way that defeats Chrome's site isolation architecture - the mechanism that places separate web origins into distinct renderer processes to contain cross-origin data leakage. The affected product scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop builds prior to the 148.0.7778.216 stable channel release.
RemediationAI
The primary fix is upgrading Google Chrome to version 148.0.7778.216 or later, which is the vendor-released patched version confirmed via the Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome's automatic update mechanism should apply this for most users; administrators managing enterprise fleets should verify rollout via group policy or MDM tooling. Because exploitation requires a pre-existing renderer compromise, organizations that cannot immediately patch should prioritize mitigations that reduce renderer exploit exposure: enabling Chrome's enhanced safe browsing mode (reduces delivery of malicious pages), enforcing strict site isolation via enterprise policy if not already default, and deploying endpoint detection capable of identifying anomalous renderer subprocess behavior. These compensating controls address the prerequisite stage of the chain rather than the ANGLE flaw itself, so patching remains the only definitive remediation.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today