EUVD-2026-40631
GHSA-hcjj-c5xx-hv34
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML page (AV:N), no attacker privileges required (PR:N), victim must visit the page (UI:R), memory leak yields high confidentiality impact (C:H) with no integrity or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory use in Chrome's CSS engine on Android exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Unauthenticated remote attackers can trigger this information leak against any Android Chrome user who visits attacker-controlled content (CVSS PR:N, UI:R), with high confidentiality impact per the CVSS vector. Notably, Chromium's internal severity rating is Medium despite the C:H CVSS impact, suggesting reliable extraction of useful sensitive data may be inconsistent in practice; no public exploit code or CISA KEV listing exists at time of analysis.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) identifies the root cause: Chrome's CSS processing engine in the Blink renderer reads memory that has not been properly initialized before use, exposing whatever bytes occupied that memory location - potentially including heap residue such as partial URL strings, cached DOM data, or other in-process content. This class of flaw is distinct from buffer overflows; the issue is that a variable's storage is accessed before a valid value is written to it, leaking ambient memory. The vulnerability is scoped exclusively to Chrome on Android, implying the code path or memory layout affected is platform-specific to the Android build of Chromium. The Chromium issue tracker reference is issues.chromium.org/issues/513204116, though access may be restricted. The fix was delivered in Chrome stable channel update 150.0.7871.47 for Android.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later, which is the confirmed patched release per Google's stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Updates are distributed through the Google Play Store; users can verify their installed version under Chrome Settings > About Chrome. For organizations managing Android fleets via EMM/MDM solutions, deploy the Chrome update policy enforcement to ensure devices are not left on vulnerable versions. If immediate patching is constrained by device management cycles, enabling Chrome's Enhanced Safe Browsing mode can reduce exposure to known malicious pages hosting crafted HTML, though this is not a substitute for patching and does not block unknown attacker infrastructure. Restricting access to untrusted or unknown websites through enterprise web filtering reduces the practical attack surface while patching is pending.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today