EUVD-2026-40519
GHSA-fmjf-m6r6-43rw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page (AV:N), no privilege needed (PR:N), user must visit the page (UI:R), confidentiality-only impact from cross-origin memory read (C:H/I:N/A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics library on macOS allows a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. Affected are all Chrome versions on Mac prior to 150.0.7871.47. The flaw stems from uninitialized memory use within ANGLE, Chrome's graphics abstraction layer, enabling residual memory contents from other security origins to be read and potentially returned to an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.23% (13th percentile), consistent with a high-CVSS flaw constrained by both user-interaction and platform requirements.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the Chromium-internal library that translates OpenGL ES API calls to platform-native graphics APIs - on macOS, this means translation to Apple Metal. CWE-457 (Use of Uninitialized Variable) describes a condition where a variable or memory buffer is consumed before it has been explicitly set to a known state, meaning it may retain data from a prior memory allocation or graphics operation. In a browser context, this is particularly dangerous because GPU-adjacent memory regions may contain pixels, textures, or data buffers belonging to content from a different web origin. By triggering the uninitialized read via a crafted WebGL or graphics-heavy HTML page, an attacker can observe this residual data, effectively breaching the Same-Origin Policy. The bug is scoped to Chrome on Mac, suggesting it is tied to the Metal translation path in ANGLE rather than the cross-platform OpenGL or Vulkan paths used on other operating systems.
RemediationAI
Update Google Chrome on macOS to version 150.0.7871.47 or later. This is confirmed as the vendor-released patch per the Chrome Stable Channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment via policy or confirm the installed version in chrome://settings/help. If immediate patching is not possible, a compensating control is to restrict or disable WebGL in Chrome via the enterprise policy DisableWebGL=true or by navigating to chrome://flags and disabling WebGL - note this will break WebGL-dependent web applications and may degrade graphics-intensive sites. Blocking access to untrusted or external web pages via proxy policy is a secondary compensating control but does not protect against attacker-controlled content served through legitimate channels such as ads.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today