EUVD-2026-34538
GHSA-jc9w-q838-488c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics library (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read memory across origin boundaries by luring a victim to a crafted HTML page. The root cause is an uninitialized variable (CWE-457) within ANGLE - Chromium's graphics translation layer - which may retain residual data from prior allocations, exposing sensitive cross-origin content. No public exploit code exists and no active exploitation is confirmed (CISA KEV absent); EPSS is 0.03% (11th percentile), indicating low current real-world exploitation pressure.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the OpenGL ES to native API (Direct3D, Vulkan, Metal) translation layer embedded in all Chromium-based browsers. CWE-457 (Use of Uninitialized Variable) occurs when a memory region is allocated but not zero-initialized before use - its contents reflect whatever data previously occupied that address, potentially including pixels, text, or other rendered content from a different origin. Because ANGLE handles cross-process GPU rendering, uninitialized reads in this subsystem are particularly sensitive: the same physical memory regions may be reused across rendering contexts for different origins, making this a class of speculative/residual data exposure rather than a classic buffer overflow. Affected CPE is implicitly all Google Chrome desktop releases prior to 149.0.7827.53 (Windows, macOS, Linux) as identified by the EUVD affected version range.
RemediationAI
The vendor-released patch is Google Chrome version 149.0.7827.53, available via Chrome's built-in auto-update mechanism or manual download from the official Chrome releases page (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Enterprises managing Chrome via policy should deploy this version through their endpoint management tooling immediately. As a compensating control prior to patching, restricting users from browsing untrusted external sites via network-layer URL filtering reduces exposure, though this is operationally disruptive. Disabling JavaScript on unknown origins using Chrome's site settings provides partial mitigation since the exploit is delivered via a crafted HTML page, but will break significant legitimate web functionality. No workaround fully substitutes for upgrading to 149.0.7827.53.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today