EUVD-2026-34538
GHSA-jc9w-q838-488c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics library (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read memory across origin boundaries by luring a victim to a crafted HTML page. The root cause is an uninitialized variable (CWE-457) within ANGLE - Chromium's graphics translation layer - which may retain residual data from prior allocations, exposing sensitive cross-origin content. No public exploit code exists and no active exploitation is confirmed (CISA KEV absent); EPSS is 0.03% (11th percentile), indicating low current real-world exploitation pressure.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the OpenGL ES to native API (Direct3D, Vulkan, Metal) translation layer embedded in all Chromium-based browsers. CWE-457 (Use of Uninitialized Variable) occurs when a memory region is allocated but not zero-initialized before use - its contents reflect whatever data previously occupied that address, potentially including pixels, text, or other rendered content from a different origin. Because ANGLE handles cross-process GPU rendering, uninitialized reads in this subsystem are particularly sensitive: the same physical memory regions may be reused across rendering contexts for different origins, making this a class of speculative/residual data exposure rather than a classic buffer overflow. Affected CPE is implicitly all Google Chrome desktop releases prior to 149.0.7827.53 (Windows, macOS, Linux) as identified by the EUVD affected version range.
RemediationAI
The vendor-released patch is Google Chrome version 149.0.7827.53, available via Chrome's built-in auto-update mechanism or manual download from the official Chrome releases page (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Enterprises managing Chrome via policy should deploy this version through their endpoint management tooling immediately. As a compensating control prior to patching, restricting users from browsing untrusted external sites via network-layer URL filtering reduces exposure, though this is operationally disruptive. Disabling JavaScript on unknown origins using Chrome's site settings provides partial mitigation since the exploit is delivered via a crafted HTML page, but will break significant legitimate web functionality. No workaround fully substitutes for upgrading to 149.0.7827.53.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today