EUVD-2026-40812
GHSA-87gc-v6c9-wrpw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted HTML page needing no auth; user must visit (UI:R); renderer sandbox limits scope; confidentiality High as process memory contents may be exposed; no integrity or availability impact described.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers who can entice a user to visit a crafted HTML page. The flaw affects all Chrome versions prior to 150.0.7871.47, with High confidentiality impact per CVSS despite Google's own Chromium severity rating of Low - a discrepancy suggesting practical extraction of meaningful data is constrained in real-world conditions. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch has been released.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is an open-source, cross-platform GPU abstraction library embedded in Chrome that translates OpenGL ES API calls to platform-native graphics backends (Direct3D on Windows, Metal on macOS, Vulkan where supported). CWE-457 (Use of Uninitialized Variable) indicates that a memory region allocated during graphics processing was read before being properly zeroed or populated, allowing whatever residual data occupied that heap or stack region to be surfaced to the rendering pipeline and potentially observable by the attacker-controlled page. This class of bug in graphics subsystems is particularly sensitive because GPU memory buffers may contain fragments of previously rendered content from other tabs, credentials, or other in-process data. Affected CPE covers Google Chrome < 150.0.7871.47 per EUVD EUVD-2026-40812.
RemediationAI
The primary fix is upgrading Google Chrome to version 150.0.7871.47 or later, delivered via the Chrome stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Organizations managing Chrome deployments via policy should push this update through their enterprise management tooling immediately. In environments where immediate patching is not feasible, restricting access to untrusted web content via proxy categorization or browser isolation platforms can reduce exposure, though these controls add operational overhead and do not eliminate risk for bring-your-own-device scenarios. Disabling WebGL via Chrome policy (--disable-webgl flag or WebGL enterprise policy) may reduce the attack surface targeting ANGLE specifically, but will break WebGL-dependent applications. No workarounds are referenced in vendor materials; patching is the authoritative remediation.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today