EUVD-2026-34493
GHSA-7m48-cg9w-6qhp
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Integer overflow in ANGLE (Google's graphics abstraction layer) within Chrome on macOS prior to 149.0.7827.53 enables remote information disclosure from process memory via crafted HTML pages. An unauthenticated remote attacker who induces user interaction can trigger out-of-bounds memory reads through a malicious webpage, potentially exposing credentials, session tokens, or other sensitive in-memory data. No active exploitation is confirmed (not listed in CISA KEV) and EPSS of 0.03% (11th percentile) reflects low real-world exploitation probability at time of analysis.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform OpenGL ES translation layer, which maps graphics API calls to platform-native backends - on macOS, this targets Metal or OpenGL. The integer overflow arises when arithmetic computations in ANGLE's memory indexing logic exceed their storage bounds, causing incorrect buffer offsets and enabling reads beyond allocated memory regions. The listed CWE-472 ('External Control of Assumed-Immutable Web Parameter') appears potentially mismatched with the described integer overflow; CWE-190 (Integer Overflow or Wraparound) would be more technically consistent with the description. This discrepancy suggests either a secondary classification or a data entry issue - analysts should treat the root cause classification with caution. The vulnerability is explicitly scoped to the macOS platform, implicating platform-specific ANGLE backend code rather than cross-platform components. No CPE strings were provided in the input data.
RemediationAI
Vendor-released patch: Chrome 149.0.7827.53 for macOS - update immediately via chrome://settings/help or allow Chrome's auto-update mechanism to apply the fix. The official advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. If immediate patching is not feasible, restricting end-user navigation to untrusted or unknown websites reduces exposure, as exploitation requires visiting a crafted HTML page (UI:R); however, this is not a substitute for the patch and carries operational trade-offs. DNS-based web filtering or enterprise browser policy restricting JavaScript-heavy or external sites can serve as a compensating control, though with limited efficacy against targeted social engineering. Note that macOS enterprise deployments managing Chrome via MDM or Google Admin should push the 149.0.7827.53 update through their standard fleet management channels rather than relying on user-initiated updates.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today