What is the CVSS score of EUVD-2026-34599?

EUVD-2026-34599 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34599?

Yes, a patch is available for EUVD-2026-34599. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34599

| CVE-2026-11138 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-3fp8-pm45-cc3h

Information Disclosure Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:30 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) allows an unauthenticated remote attacker to read sensitive data belonging to other web origins by enticing a user to visit a specially crafted HTML page. The root cause is an uninitialized variable use (CWE-457) within ANGLE - Chrome's OpenGL ES translation layer - which can expose heap or stack memory contents across origin boundaries. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.03% (11th percentile) indicates low observed exploitation probability at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform OpenGL ES to native graphics API translation layer, used to enable WebGL and hardware-accelerated canvas rendering on Windows, macOS, and Linux. CWE-457 (Use of Uninitialized Variable) describes a condition where memory is read before being properly initialized, potentially exposing stale heap or stack contents. In the context of a browser, this class of flaw in a graphics subsystem is particularly sensitive because GPU buffers, shared memory regions, or intermediate render targets could contain data from previously processed cross-origin frames or resources. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects that the vulnerability is network-reachable, requires no privileges, carries high confidentiality impact, but is limited to an unchanged scope and requires user interaction to trigger. Affected CPE is Google Chrome prior to version 149.0.7827.53 per ENISA EUVD data.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which is confirmed as the patched release per the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this update automatically; users can manually trigger it via Chrome menu → Help → About Google Chrome. For enterprise environments using Chrome Enterprise or Extended Stable channels, verify whether the fix has been backported to the relevant managed channel and push the update via policy. If immediate patching is not possible, a compensating control is to disable WebGL via enterprise policy (setting 'WebGLEnabled' to false), though this will break WebGL-dependent web applications and may degrade hardware-accelerated rendering. Restricting access to untrusted web content via URL allowlisting or supervised browsing policies also reduces exposure but does not eliminate risk from compromised trusted sites.