What is the CVSS score of EUVD-2026-41193?

EUVD-2026-41193 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-41193?

Yes, a patch is available for EUVD-2026-41193. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-41193

| CVE-2026-14408 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-07-01 Chrome

GHSA-xjcr-jqgm-wxc5

Information Disclosure Google Red Hat

6.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page; no privileges required; user must actively interact; read-only memory disclosure means confidentiality impact only, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:41 vuln.today

CVE Published

Jul 01, 2026 - 22:22 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 01, 2026 - 22:22 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory exposure in Google Chrome's Dawn WebGPU component (versions prior to 150.0.7871.46) allows remote attackers to read potentially sensitive data from the Chrome renderer process. Exploitation requires a victim to visit a crafted HTML page, after which residual process memory - potentially containing credentials, session tokens, or other in-memory secrets - may be disclosed to the attacker. No public exploit identified at time of analysis; EPSS of 0.20% (10th percentile) and SSVC exploitation status of 'none' confirm low immediate exploitation likelihood despite the medium-severity CVSS rating.

Technical ContextAI

Dawn is Google's open-source, cross-platform implementation of the WebGPU API, used as the GPU backend within Chrome's renderer process. CWE-457 (Use of Uninitialized Variable) indicates that a buffer or variable within Dawn's code is read before it is properly zeroed or assigned, causing residual heap or stack data from prior allocations to be accessible. This class of flaw is particularly common in graphics and GPU driver code where performance-sensitive memory management routinely skips zero-initialization. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all platform variants of Chrome prior to 150.0.7871.46. The ENISA EUVD entry EUVD-2026-41193 independently corroborates the affected version boundary.

RemediationAI

The primary fix is upgrading Google Chrome to version 150.0.7871.46 or later, as confirmed by the vendor advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism will apply this fix automatically in most consumer and unmanaged enterprise deployments; administrators should verify the installed version via chrome://settings/help. Enterprises using managed update policies (Google Admin Console, Chromebook EMM, or SCCM/Intune for Chrome) should push the stable channel update containing 150.0.7871.46. SUSE users should monitor their vendor's security advisories for patched Chromium packages. No viable workaround short of upgrading exists - disabling WebGPU/Dawn would break an increasing share of modern web content and is not recommended as a compensating control in most environments. Patch availability per vendor advisory is confirmed; exact fix version 150.0.7871.46 is independently corroborated by EUVD data.