EUVD-2026-34379
GHSA-8hmc-m9jw-q8ph
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Out of bounds read in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds memory read in Google Chrome's ANGLE graphics layer on macOS versions prior to 149.0.7827.53 allows remote attackers to disclose memory contents or crash the renderer by enticing a user to visit a crafted HTML page. Google rates the underlying Chromium issue as High severity, and while no public exploit is identified at time of analysis, the EPSS score of 0.03% suggests low near-term mass exploitation likelihood. The flaw requires user interaction (visiting a page) but no authentication, making drive-by web attacks the realistic threat model.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL and OpenGL ES API calls onto the host platform's native graphics API - on macOS this typically means Metal or the legacy OpenGL backend. The CWE-125 (Out-of-bounds Read) root cause indicates that ANGLE reads past the bounds of an allocated buffer when processing attacker-controlled graphics data, likely while parsing shader inputs, texture data, or vertex/index buffers supplied through WebGL from a webpage. Because ANGLE runs inside Chrome's GPU/renderer process, the read can leak memory contents from those processes, which may include sensitive data such as cross-origin pixel data, JavaScript heap fragments, or other process state that aids further exploitation.
RemediationAI
Vendor-released patch: Google Chrome 149.0.7827.53 or later for macOS - update via Chrome's built-in updater (chrome://settings/help) or redeploy through managed-update tooling such as Jamf, Intune, or Chrome Browser Cloud Management; details are in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. As a compensating control until patching completes, administrators can disable WebGL via the WebGLAllowedForUrls/DefaultWebGLSetting enterprise policies or by setting the chrome://flags WebGL option, which removes the most likely attack surface for ANGLE bugs but breaks legitimate 3D web content, in-browser games, and some mapping and data-visualization sites. Restricting browsing to a curated allowlist via URLBlocklist/URLAllowlist policies further reduces exposure to attacker-controlled HTML at the cost of user productivity.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today