What is the CVSS score of EUVD-2026-33212?

EUVD-2026-33212 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33212?

Yes, a patch is available for EUVD-2026-33212. Update the affected software to the latest version immediately.

Google Chrome Android EUVD-2026-33212

| CVE-2026-9917 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-2h7h-74r2-6cr3

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:25 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized memory exposure in the WebGL subsystem of Google Chrome on Android prior to 148.0.7778.216 allows unauthenticated remote attackers to read potentially sensitive data from browser process memory. Exploitation requires the victim to visit a specially crafted HTML page, placing this in the drive-by/social-engineering threat category rather than fully automated attacks. No public exploit code identified at time of analysis, and EPSS of 0.03% (10th percentile) reflects minimal current exploitation pressure despite the High CVSS confidentiality impact.

Technical ContextAI

WebGL is the browser-native API for GPU-accelerated 2D/3D graphics, exposed via JavaScript and processed within the browser's renderer. CWE-457 (Use of Uninitialized Variable) describes a root cause where memory is allocated but not zeroed or otherwise initialized before being read; any residual data occupying that memory region - potentially including fragments of prior computations, credential material, or session state - becomes readable and can be surfaced to the attacker. On Android, Chrome's WebGL implementation contains a code path where a variable is consumed before initialization is guaranteed, enabling this information disclosure. Affected products per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) are all Chrome versions on Android prior to 148.0.7778.216, as confirmed by the EUVD affected-version range and Google's stable channel advisory.

RemediationAI

Vendor-released patch: Chrome 148.0.7778.216 for Android. Users should update immediately via the Google Play Store; Chrome typically applies background updates automatically when connected to Wi-Fi, but manual update verification is recommended for high-risk environments. The patch release is documented at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As a compensating control before patching, enterprise administrators can deploy Chrome browser policies to restrict navigation to untrusted or unknown origins, reducing exposure to attacker-controlled pages; this trades browsing flexibility for reduced attack surface. Disabling WebGL via enterprise policy (--disable-webgl flag or corresponding policy key) would eliminate the vulnerable code path but will break legitimate WebGL-dependent web applications, making it unsuitable for general-purpose deployments. There are no documented workarounds that preserve full WebGL functionality while mitigating the vulnerability.