EUVD-2026-40563
GHSA-96cx-548v-f4qx
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML (AV:N), AC:H for mandatory prior renderer compromise; C:H for process memory read; no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Process memory disclosure in Google Chrome's ANGLE graphics abstraction layer (versions prior to 150.0.7871.47) enables a renderer-compromised attacker to read potentially sensitive data from process memory via a crafted HTML page. This is a post-exploitation, second-stage vulnerability: it cannot be triggered without a prior renderer process compromise, functioning as a chaining component rather than a standalone entry point. No public exploit code or CISA KEV listing has been identified at time of analysis; Chromium's own team rates it Medium severity, consistent with the prerequisite attack complexity.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform GPU abstraction layer, translating OpenGL ES API calls to native graphics backends (DirectX on Windows, Metal on macOS, Vulkan on Linux). It operates as a bridge between the sandboxed renderer process and the GPU process. The root cause is CWE-20 (Improper Input Validation): ANGLE fails to adequately validate attacker-controlled input arriving from a compromised renderer, resulting in unintended reads from process memory. This fits the established Chromium sandbox escape/chaining pattern, where a GPU-layer flaw is leveraged after initial renderer access. Affected versions per EUVD-2026-40563 are all Chrome desktop builds prior to 150.0.7871.47.
RemediationAI
The primary and definitive fix is upgrading Google Chrome to version 150.0.7871.47 or later, as documented in the Google stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will apply this for most managed and consumer endpoints with no manual intervention. Since this vulnerability requires prior renderer process compromise, defenders can also reduce the overall attack surface by enforcing Chrome's Site Isolation (--site-per-process, enabled by default in modern Chrome), which limits what a compromised renderer can access. Restricting users to trusted web content via web filtering reduces the likelihood of the prerequisite renderer compromise being established in the first place. No workaround that specifically addresses the ANGLE input validation flaw without patching has been identified.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today