What is the CVSS score of EUVD-2026-33086?

EUVD-2026-33086 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33086?

Yes, a patch is available for EUVD-2026-33086. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-33086

| CVE-2026-9944 LOW

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-h44x-g8cv-p3qx

Google Information Disclosure Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:28 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

3.1 (LOW)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized use (CWE-457) in ANGLE, Chrome's graphics abstraction layer, exposes cross-origin data to attackers who have already compromised the renderer process in Google Chrome prior to 148.0.7778.216. Exploitation requires delivering a crafted HTML page to a victim who interacts with it, making this a post-compromise data exfiltration primitive rather than an initial access vector. The CVSS score of 3.1 and EPSS of 0.03% (11th percentile) are consistent with the constrained prerequisites; no public exploit code exists and no active exploitation has been confirmed.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics translation library that maps OpenGL ES calls to platform-native APIs such as DirectX (Windows), Metal (macOS), and Vulkan. CWE-457 (Use of Uninitialized Variable) describes a class of bugs where allocated memory is read before being initialized, potentially exposing residual contents from prior allocations. In this case, the uninitialized state within ANGLE's rendering pipeline can be observed by a compromised renderer process, leaking data that may include cross-origin content from adjacent memory regions. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD-2026-33086 confirm all Chrome desktop versions prior to 148.0.7778.216 are in scope, with no platform differentiation indicated in available data.

RemediationAI

The vendor-released patch is Google Chrome 148.0.7778.216, confirmed by the official Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Users should verify their installed version via chrome://settings/help and allow Chrome's auto-update mechanism to apply the fix, or manually trigger an update. Because this vulnerability requires a pre-existing renderer compromise, organizations that have already enabled Chrome's Site Isolation feature gain meaningful defense-in-depth by limiting renderer access to cross-origin data; this can be verified at chrome://process-internals. No functional workaround exists that addresses the uninitialized memory condition itself without upgrading, as it resides in a core graphics rendering path used across all content types.