What is the CVSS score of EUVD-2026-34515?

EUVD-2026-34515 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34515?

Yes, a patch is available for EUVD-2026-34515. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34515

| CVE-2026-11067 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-8772-33fg-r56f

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:46 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory read in Chrome's Dawn (WebGPU) component exposes process memory contents to remote unauthenticated attackers who can entice a user to visit a crafted HTML page. All Chrome desktop versions prior to 149.0.7827.53 are affected, with confidentiality impact rated High (C:H) due to potential exposure of sensitive in-process data such as credentials or session tokens. No public exploit code or active exploitation has been identified at time of analysis; EPSS at 0.03% (11th percentile) reflects low current exploitation pressure.

Technical ContextAI

Dawn is Google Chrome's cross-platform implementation of the WebGPU graphics API, responsible for translating high-level GPU commands into native API calls (Metal, Vulkan, D3D12). CWE-457 (Use of Uninitialized Variable) indicates that a memory buffer is allocated but not zeroed or properly initialized before being read or returned, allowing its stale contents - potentially drawn from prior allocations in the same process - to be observed by an attacker-controlled context. In a renderer process handling a crafted HTML page, this class of bug can leak heap or stack residue that may contain sensitive browser state. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms exploitation is network-delivered with low complexity and no required privileges, constrained only by requiring user interaction (page visit).

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which is confirmed by Google's stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) to include the fix for this issue. Chrome's auto-update mechanism will deliver this patch automatically; users should verify their version via chrome://settings/help and restart the browser to apply any pending update. No documented workarounds are available that would allow continued use of WebGPU/Dawn without the risk; if organizational policy requires delaying updates, restricting access to untrusted or external web content via enterprise policy (e.g., URL allowlisting) can reduce exposure, though this trade-off limits general browsing functionality. Enterprise administrators should prioritize deployment of 149.0.7827.53 through their standard Chrome management infrastructure.