EUVD-2026-50607
GHSA-9j45-6833-228p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page invoking WebNN
-
DeliveryVictim navigates to page in Chrome on Windows
-
ExploitWebNN allocates uninitialized buffer
-
ExecutionAttacker script reads buffer bytes
-
ImpactCross-origin data fragments exfiltrated
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Requires active user interaction: the victim must navigate to an attacker-controlled or attacker-influenced HTML page in Chrome on Windows (UI:R in CVSS). The WebNN API must be reachable by the page - it is part of Chrome's standard web API surface and requires no special opt-in configuration, so no non-default setup is needed. No authentication or privileges are required of the attacker (PR:N). Exploitation is limited to Windows; other operating systems are not listed as affected. The impact is bounded to partial cross-origin data disclosure (C:L) - full memory read or code execution are not achievable through this flaw alone. The requirement for user navigation to a crafted page is the primary limiting factor for mass exploitation. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N reflects a realistic assessment: the flaw is network-reachable with no complexity or privilege barrier on the attacker side, but requires user interaction and delivers only partial confidentiality impact with no integrity or availability consequences. EPSS at 0.20% (10th percentile) is very low, indicating the security community does not currently expect widespread exploitation. There is no CISA KEV listing and no known public exploit, making this a theoretical risk rather than an active threat. Real-world priority is low for most organizations relative to higher-EPSS or KEV-listed flaws, though the ubiquity of Chrome on Windows means the raw exposure surface is enormous. The practical data leakage is constrained to fragments accessible via the WebNN uninitialized buffer, not arbitrary memory read. |
| Exploit ScenarioDerived | An attacker serves a crafted web page that invokes the WebNN API in a way that causes Chrome to read from an uninitialized memory buffer. When a Windows user on a vulnerable Chrome version visits the page, the script extracts bytes from that buffer and exfiltrates them to an attacker-controlled endpoint, potentially revealing fragments of data belonging to another origin previously loaded in the browser. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Settings > About Chrome) or through enterprise deployment tooling (Google Update, ADMX policies). The fix is documented in the Chrome Stable Channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate patching is operationally blocked, enforcing strict Content Security Policy headers on internally controlled sites reduces attacker-controlled HTML surface, though it does not address externally hosted threats. Restricting Chrome's access to untrusted domains via enterprise browser policy is a partial compensating control but significantly impacts usability. Given the low EPSS and absence of known exploits, applying the patch during the next standard maintenance window is appropriate for most environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebNN (Web Neural Network API) is a browser-native API exposing hardware-accelerated ML inference to web pages, introduced in Chromium. CWE-457 (Use of Uninitialized Variable) indicates that memory is allocated but not zeroed or otherwise initialized before use, meaning the buffer retains whatever bytes previously occupied that memory region - potentially belonging to another origin's data or prior browser operations. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Windows, with the vulnerability resolved in 151.0.7922.72. The Windows-specific nature suggests platform-specific memory management or WebNN backend behavior may be the root cause, as other OS versions are not listed.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted HTML page requiring victim navigation (UI:R); uninitialized read leaks only partial data (C:L) with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB