EUVD-2026-33160
GHSA-3q74-cwq3-c724
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Integer overflow in ANGLE (Chrome's graphics translation layer) in Google Chrome prior to 148.0.7778.216 enables remote attackers to read sensitive data from the renderer process memory by enticing a victim to visit a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity impact is indicated by CVSS (C:H/I:N/A:N). With an EPSS of 0.03% and no CISA KEV listing, active exploitation is not currently observed, though the network-accessible attack vector and low complexity make the attack straightforward once a victim visits attacker-controlled content.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is an open-source graphics abstraction library bundled within Google Chrome that translates OpenGL ES 2/3 API calls into platform-native graphics APIs - Direct3D on Windows, Metal on macOS, and Vulkan or desktop OpenGL on Linux. An integer overflow in ANGLE can corrupt internal size or offset calculations, leading to an out-of-bounds read of heap memory within the renderer process. The assigned CWE is CWE-472 ('External Control of Assumed-Immutable Web Parameter'), which is atypical for an arithmetic integer overflow - CWE-190 (Integer Overflow or Wraparound) would conventionally apply here. This CWE mismatch may indicate the overflow is triggered through an attacker-controlled parameter passed from a web page into the ANGLE pipeline, which would align the two CWEs. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms running Chrome versions before 148.0.7778.216.
RemediationAI
The primary fix is to upgrade Google Chrome to version 148.0.7778.216 or later, which contains the vendor-released patch as documented in the Chrome stable channel release advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome auto-updates by default on most platforms; administrators managing enterprise fleets should verify deployment of this version via policy. For environments where immediate upgrade is not feasible, the most effective compensating control is to restrict or supervise user browsing to untrusted sites - particularly blocking access to unvetted external HTML content - since exploitation requires visiting a crafted page. Additionally, deploying browser isolation solutions or sandboxing (e.g., Chrome Site Isolation) can limit the practical impact of memory reads by confining what data is accessible within a renderer process. Note that disabling hardware acceleration (which would bypass ANGLE for some rendering paths) is a potential workaround but carries significant rendering performance trade-offs and is not verified to fully eliminate the attack surface.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today