EUVD-2026-34443
GHSA-mqrm-gc2f-mchp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory read in Chrome's ANGLE graphics layer exposes process memory contents to remote attackers who can trick users into visiting a crafted HTML page. Affected are all Chrome releases prior to 149.0.7827.53 on desktop platforms, as confirmed by the Google Chrome Releases advisory. No public exploit identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates low current exploitation probability; however, the CVSS confidentiality impact is rated High, meaning successful exploitation could yield sensitive in-process data such as credentials, tokens, or cryptographic material resident in memory.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform OpenGL ES implementation that translates WebGL and graphics API calls to platform-native backends such as DirectX on Windows or Metal on macOS. CWE-457 (Use of Uninitialized Variable) describes a condition where a variable or memory buffer is consumed before it has been explicitly initialized, causing the code to read whatever bytes were previously resident at that memory location - commonly heap or stack remnants from prior allocations. In Chrome's renderer process, ANGLE handles GPU-accelerated content rendered from HTML/JavaScript, meaning a crafted page can deliberately trigger graphics operations that cause ANGLE to dereference or return uninitialized buffer contents. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop variants prior to the fixed release.
RemediationAI
The primary fix is to update Google Chrome to version 149.0.7827.53 or later, as released in the June 2026 Stable Channel Update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this patch automatically on supported platforms; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or group policy. If immediate patching is not feasible, restricting access to untrusted or external websites via web content filtering reduces exposure, though this carries significant operational impact. Disabling WebGL (via the --disable-webgl flag or enterprise policy) may reduce the ANGLE attack surface, but will break GPU-accelerated web content and is not a substitute for patching. There are no vendor-published workarounds short of upgrading.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today