EUVD-2026-41180
GHSA-x6w2-jpmx-x267
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page requires user interaction; read-only memory disclosure produces no integrity or availability impact; renderer sandbox limits but does not eliminate confidentiality exposure.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds read in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome prior to 150.0.7871.46 exposes process memory to remote attackers via a crafted HTML page. An unauthenticated remote attacker can cause a victim's browser to disclose potentially sensitive process memory - such as cached credentials or heap artifacts - with no integrity or availability impact. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS at 0.23% (14th percentile) confirms low near-term exploitation probability.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google's open-source graphics abstraction library embedded in Chrome that translates OpenGL ES API calls into platform-native graphics APIs - DirectX on Windows, Metal on macOS, and OpenGL on Linux. CWE-125 (Out-of-Bounds Read) occurs when code reads past the end of an allocated buffer, potentially exposing adjacent memory contents to the caller. In this context, a crafted HTML page likely exploits malformed WebGL or hardware-accelerated canvas operations to induce ANGLE into reading beyond a valid buffer boundary, leaking fragments of the renderer process memory. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome versions prior to 150.0.7871.46. The SUSE tag indicates downstream Linux distribution packages (Chromium on SUSE/openSUSE) are also affected and require independent patching.
RemediationAI
Update Google Chrome to version 150.0.7871.46 or later, available immediately via Chrome's built-in auto-updater or through the official release blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. SUSE and openSUSE administrators should apply the corresponding Chromium package update via zypper or YaST, noting that distribution packages may not yet reflect the upstream fix. If immediate patching is not feasible, restricting navigation to explicitly trusted domains via enterprise browser policy (e.g., URL allowlists through Chrome Browser Cloud Management) reduces the attack surface, but this carries significant usability impact in unrestricted browsing environments. Disabling hardware-accelerated graphics (chrome://settings/system - 'Use hardware acceleration when available') may prevent ANGLE from processing attacker-supplied graphics primitives, though this degrades rendering performance noticeably. Chrome's sandbox provides partial containment of memory disclosures even on unpatched builds, limiting but not eliminating risk.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today