EUVD-2026-33212
GHSA-2h7h-74r2-6cr3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory exposure in the WebGL subsystem of Google Chrome on Android prior to 148.0.7778.216 allows unauthenticated remote attackers to read potentially sensitive data from browser process memory. Exploitation requires the victim to visit a specially crafted HTML page, placing this in the drive-by/social-engineering threat category rather than fully automated attacks. No public exploit code identified at time of analysis, and EPSS of 0.03% (10th percentile) reflects minimal current exploitation pressure despite the High CVSS confidentiality impact.
Technical ContextAI
WebGL is the browser-native API for GPU-accelerated 2D/3D graphics, exposed via JavaScript and processed within the browser's renderer. CWE-457 (Use of Uninitialized Variable) describes a root cause where memory is allocated but not zeroed or otherwise initialized before being read; any residual data occupying that memory region - potentially including fragments of prior computations, credential material, or session state - becomes readable and can be surfaced to the attacker. On Android, Chrome's WebGL implementation contains a code path where a variable is consumed before initialization is guaranteed, enabling this information disclosure. Affected products per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) are all Chrome versions on Android prior to 148.0.7778.216, as confirmed by the EUVD affected-version range and Google's stable channel advisory.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.216 for Android. Users should update immediately via the Google Play Store; Chrome typically applies background updates automatically when connected to Wi-Fi, but manual update verification is recommended for high-risk environments. The patch release is documented at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. As a compensating control before patching, enterprise administrators can deploy Chrome browser policies to restrict navigation to untrusted or unknown origins, reducing exposure to attacker-controlled pages; this trades browsing flexibility for reduced attack surface. Disabling WebGL via enterprise policy (--disable-webgl flag or corresponding policy key) would eliminate the vulnerable code path but will break legitimate WebGL-dependent web applications, making it unsuitable for general-purpose deployments. There are no documented workarounds that preserve full WebGL functionality while mitigating the vulnerability.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today