EUVD-2026-33085
GHSA-pchx-cxc9-82h3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebGL implementation on Android affects all Chrome versions prior to 148.0.7778.216. The WebGL graphics subsystem performs an out-of-bounds read (CWE-125) when processing attacker-controlled content, exposing adjacent memory contents across origin boundaries to the initiating page. Remote unauthenticated attackers can trigger this condition by serving a crafted HTML page, but victim interaction is required - the user must visit the malicious page. No active exploitation is confirmed (not listed in CISA KEV), and EPSS of 0.03% (10th percentile) indicates low exploitation probability at time of analysis.
Technical ContextAI
WebGL (Web Graphics Library) is a JavaScript API that exposes GPU-accelerated 2D and 3D rendering directly in the browser sandbox. It interfaces with device GPU drivers, which historically have been a fertile attack surface. The root cause class here is CWE-125 (Out-of-bounds Read): the WebGL implementation reads memory beyond its allocated buffer boundary, which can expose adjacent in-process memory to the JavaScript caller. In a browser context, this translates to a Same-Origin Policy (SOP) bypass - the attacker's origin gains read access to memory that may contain data belonging to another origin loaded in the same process. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome versions up to the fix are implicated, with the Android platform specifically identified in the CVE description. Chrome internally classified this as High severity, reflecting the sensitivity of cross-origin data leakage as a browser security primitive violation even when the direct CVSS score is moderate.
RemediationAI
Update Google Chrome on Android to version 148.0.7778.216 or later, available immediately through the Google Play Store or Chrome's in-app update mechanism (Settings > About Chrome). The patch is confirmed available per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For organizations managing Android device fleets via MDM or EMM solutions, push the Chrome update as a forced policy update. If immediate patching is operationally blocked, disabling WebGL via Chrome enterprise policy (setting WebGLEnabled to false in managed configuration) eliminates the vulnerable code path entirely - note this will break any web application relying on WebGL-based rendering (3D maps, browser-based design tools, data visualizations). Given the user-interaction requirement and low EPSS score, this vulnerability does not warrant emergency out-of-band response for most organizations, but patch deployment within the standard monthly cycle is appropriate.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today