EUVD-2026-34598
GHSA-9vj8-prvx-2qp4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory exposure in Google Chrome's ANGLE graphics library prior to version 149.0.7827.53 enables remote unauthenticated attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms no attacker privileges are required but victim interaction is mandatory - the attack is entirely browser-side and exploits how ANGLE handles graphics state without zeroing memory first. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating low observed exploitation interest despite the High confidentiality impact rating.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the cross-platform graphics abstraction layer embedded in Chromium that translates OpenGL ES calls to platform-native APIs such as Direct3D, Metal, and Vulkan. CWE-457 (Use of Uninitialized Variable) indicates that a graphics-related data structure or buffer within ANGLE is allocated but not fully zeroed before being read or used in a computation. Because process memory may contain residual data from prior allocations - including renderer state, JavaScript heap fragments, or other browser internals - an uninitialized read in a graphics code path can inadvertently surface that data to a malicious page via timing side-channels or direct memory disclosure. Affected versions are all Chrome releases prior to 149.0.7827.53, as confirmed by the EUVD affected version range 'Chrome 149.0.7827.53 < 149.0.7827.53' and the Google Chrome Stable Channel Update advisory.
RemediationAI
The vendor-released patch is Google Chrome 149.0.7827.53, confirmed by the Google Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators and end users should update Chrome immediately via the browser's built-in updater (Settings → About Chrome) or through enterprise deployment tools such as Google Admin Console or SCCM. For environments where immediate patching is constrained, short-term compensating controls include enforcing Chrome's Site Isolation feature (already enabled by default in recent versions) to limit cross-origin memory exposure, blocking access to untrusted external websites via proxy policy, and deploying browser extensions or enterprise policies that restrict navigation to allow-listed domains. Note that these controls reduce attack surface but do not eliminate the underlying vulnerability - patching to 149.0.7827.53 or later is the only confirmed fix.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today