EUVD-2026-33206
GHSA-3px4-28qc-4f47
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds memory read via integer overflow in Chrome's ANGLE graphics layer exposes limited memory contents to remote attackers who can lure victims to a malicious page. Affected are all Google Chrome versions prior to 148.0.7778.216 on desktop platforms. The vulnerability carries a CVSS score of 4.3 (Medium) with a confidentiality-only impact; no public exploit code exists and no active exploitation has been confirmed, with EPSS at 0.03% (11th percentile), placing real-world risk at low-to-moderate despite the network-accessible attack vector.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction library that translates OpenGL ES API calls to platform-native APIs such as DirectX (Windows), Metal (macOS), and Vulkan. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 148.0.7778.216. The root cause is an integer overflow in ANGLE's internal arithmetic - when processing attacker-controlled values from a crafted HTML page (likely via WebGL or Canvas rendering paths), an integer computation overflows, producing an incorrect buffer size or offset that causes a subsequent read to exceed valid memory boundaries, resulting in an out-of-bounds memory read. It is worth flagging that the assigned CWE is CWE-472 ('External Control of Assumed-Immutable Web Parameter'), which is inconsistent with the described integer overflow and OOB read primitive; the vulnerability more accurately maps to CWE-190 (Integer Overflow) chained with CWE-125 (Out-of-Bounds Read). This discrepancy should be treated as a data quality issue in the NVD/EUVD entry.
RemediationAI
The vendor-released patch is Google Chrome version 148.0.7778.216, available via the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Users and administrators should update Chrome to 148.0.7778.216 or later using Chrome's built-in update mechanism (Settings → About Chrome) or via enterprise deployment tooling. No workaround is documented by the vendor. If immediate patching is not feasible in enterprise environments, a compensating control is to restrict access to untrusted or external web content through proxy filtering or browser isolation solutions, noting this adds operational friction and does not eliminate the vulnerability for internally hosted malicious content. Chromium-derived browsers should be checked against their own advisory feeds for equivalent fixes.
Same technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today