EUVD-2026-40638
GHSA-75qx-877v-f9ff
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; PR:N because the initial attack vector requires no credentials; C:H for potentially sensitive memory leak; I:N and A:N as no write or denial impact exists.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized GPU memory use in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to read sensitive data from GPU process memory by delivering a crafted HTML page. This is a second-stage information disclosure primitive - exploitation is contingent on a prior renderer compromise, making it a component of a multi-vulnerability attack chain rather than a standalone critical issue. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a patched stable channel build (150.0.7871.47).
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a class of memory safety flaw where a variable or buffer is read before it has been assigned a valid value, potentially exposing whatever residual data occupies that memory region. The affected component is Chrome's GPU process, a distinct OS-level process in Chrome's multi-process architecture responsible for accelerated graphics operations. Chrome isolates web content in sandboxed renderer processes that communicate with the GPU process via IPC. A renderer already under attacker control can issue malformed or crafted IPC calls to the GPU process, triggering the uninitialized read and leaking memory contents back to the renderer - bypassing the sandbox's information barrier. The affected product is Google Chrome for desktop (Windows, macOS, Linux) in all versions prior to 150.0.7871.47, as confirmed by the EUVD affected-version range and the Google Chrome Releases advisory.
RemediationAI
The primary fix is to update Google Chrome to version 150.0.7871.47 or later via the browser's built-in update mechanism (Settings → Help → About Google Chrome) or through enterprise deployment tools; the patch is confirmed available from Google per the stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation requires a prior renderer compromise, organizations that have not yet patched should prioritize ensuring Chrome's site isolation (--site-per-process, enabled by default) is not disabled via enterprise policy, as disabling it would lower the bar for renderer compromise. As an interim compensating control, restricting browsing to trusted sites via proxy filtering reduces exposure, though this is operationally disruptive. No side effects of applying the patch have been noted in the advisory. Chromium-derived browser vendors should be monitored for their own patch releases against the upstream Chromium commit.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today