EUVD-2026-42481
GHSA-qj6x-x634-3rc3
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Crafted HTML page delivers exploit over network with no auth; user must visit page (UI:R); impact is confidentiality-only memory leak, no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers across all desktop Chrome versions prior to 150.0.7871.115. The flaw is triggered by a crafted HTML page requiring user interaction, limiting automated mass exploitation - consistent with SSVC classifying it as non-automatable with partial technical impact. No public exploit code exists and EPSS sits at 0.18% (7th percentile), but Chrome's ubiquitous deployment footprint and the high confidentiality impact still justify prompt patching.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics API translation layer that maps OpenGL ES calls to platform-native graphics APIs - DirectX on Windows, Metal on macOS, and Vulkan or desktop OpenGL on Linux. CWE-457 (Use of Uninitialized Variable) in this context means that one or more memory buffers within ANGLE's rendering pipeline are read before being properly zeroed or populated, allowing attacker-controlled shader or graphics operations to surface arbitrary bytes from heap or stack memory. In a browser process, such memory regions may contain cross-origin content, authentication tokens, cached credentials, or other sensitive session data. The vulnerability is exposed via the HTML renderer accepting crafted page content, meaning the attack surface is the standard browser content process accessible to any webpage.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.115 or later - this is the vendor-confirmed fixed release per the stable channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01162222768.html. Chrome's built-in auto-update mechanism (Help > About Google Chrome) will deliver the patch automatically; enterprise deployments should verify propagation via policy management tools. Where immediate patching is not feasible, organizations may restrict WebGL via Chrome enterprise policy (disabling the chrome://flags/#enable-webgl flag or using the WebGLEnabled policy set to false), which removes a primary trigger surface for ANGLE-based flaws - though this will break legitimate WebGL-dependent applications and should be treated as a temporary measure only. Chromium-derived browsers (Edge, Brave, Opera) should be independently verified and updated once their respective vendors release corresponding patches.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today