EUVD-2026-41179
GHSA-w63p-jr39-2686
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack delivered via crafted HTML page over network with no auth; user must visit page (UI:R); only confidentiality impacted via memory read, no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction layer) prior to version 150.0.7871.46 allows a remote attacker to extract potentially sensitive data from the browser's process memory by directing a victim to a crafted HTML page. The CVSS vector confirms network delivery with no authentication required but mandates user interaction, and the High confidentiality impact (C:H) indicates that in-memory data such as session tokens, cached credentials, or page content could be exposed. SSVC assessment records no active exploitation and the flaw is absent from the CISA KEV catalog; a vendor patch has been released and no public exploit code has been identified at time of analysis.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google's open-source graphics compatibility layer embedded in Chrome that translates OpenGL ES API calls to native platform graphics APIs - Direct3D on Windows, Metal on macOS, and Vulkan or OpenGL on Linux. CWE-125 (Out-of-Bounds Read) identifies the root cause as a memory read operation that accesses a buffer beyond its allocated boundary, exposing adjacent memory contents. This class of flaw in graphics pipelines typically arises when attacker-controlled shader parameters, texture dimensions, or geometry data are not bounds-checked before being used as memory offsets or indices during rendering. Because ANGLE processes content derived from HTML pages, the attack surface is reachable from the renderer process handling untrusted web content. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome platform variants (Windows, macOS, Linux) below the fixed release.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.46 or later, which contains the vendor-released patch as documented in the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will apply this fix for most consumer deployments; enterprise administrators should verify rollout completion via Group Policy, Chrome Browser Cloud Management, or equivalent fleet tooling and force-update where automatic updates are deferred. If an immediate upgrade is not operationally feasible, restricting end-user access to untrusted external websites through URL filtering or web proxy controls reduces exposure but carries significant usability impact and does not fully eliminate risk from compromised or attacker-controlled trusted sites. Disabling GPU hardware acceleration would likely prevent the vulnerable ANGLE codepath from executing but is not a supported or recommended mitigation by Google and would degrade browser performance considerably.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today