EUVD-2026-40646
GHSA-w7cm-fh2f-3jph
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N and UI:R reflect webpage delivery requiring one user visit; C:H for uncontrolled process memory read; I:N and A:N as no write or crash capability exists.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized memory use in the codec subsystem of Google Chrome on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. All Chrome for Windows releases prior to 150.0.7871.47 are affected; the flaw is platform-specific and does not affect Chrome on Linux, macOS, or mobile. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, though the CVSS C:H rating reflects meaningful confidentiality risk, and the uninitialized read could serve as a precursor step toward ASLR bypass in a chained attack.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a memory-safety flaw where a buffer or variable is read before being explicitly written, allowing residual heap or stack data from prior allocations to leak. In Chrome, this flaw resides in the codec processing layer - the subsystem responsible for decoding audio and video media embedded in HTML pages. When the renderer process decodes attacker-supplied media, it reads uninitialized memory, which may contain sensitive data from prior allocations within the same process space. On Windows, heap memory layout and the absence of mandatory zeroing on allocation make this class of bug particularly exploitable for information leakage. The affected product is confirmed by EUVD-2026-40646 and the vendor advisory as Google Chrome for Windows, versions prior to 150.0.7871.47.
RemediationAI
Update Google Chrome on Windows to version 150.0.7871.47 or later, which is confirmed to contain the vendor-released patch per the official advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; users and administrators can verify or trigger the update via Chrome menu → Help → About Google Chrome. Enterprise administrators should push the update via Chrome Enterprise management or Google Update policy. As a compensating control prior to patching, organizations can enforce Chrome Enterprise URL allowlists or blocklists to restrict navigation to untrusted sites, reducing the attack surface; however, this does not eliminate risk for users who legitimately browse external content. Disabling codec functionality is not a practical workaround given its pervasive use in modern web content.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today