EUVD-2026-50721
GHSA-mc99-cw2x-j9qh
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N, AC:L), victim must actively visit it (UI:R), no attacker privileges needed (PR:N), impact is read-only partial memory leak (C:L, I:N, A:N) with no scope change.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Technical ContextAI
WebGL is Chrome's JavaScript API providing hardware-accelerated 2D/3D graphics via an HTML canvas element, backed by the OpenGL ES specification and processed through Chrome's GPU process. CWE-125 (Out-of-bounds Read) indicates that Chrome's WebGL subsystem fails to enforce buffer boundary checks when parsing attacker-controlled graphics primitives from a crafted HTML page, allowing reads beyond the intended memory allocation. The affected CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions across platforms prior to the 151.0.7922.72 stable channel release. The 'Buffer Overflow' tag in the intelligence feed conflicts with the authoritative CWE-125 classification - this is a read-only primitive, not a write, which materially limits exploitability. Google internally rated this Medium severity, consistent with limited impact scope.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the Stable Channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default, but enterprise administrators should verify propagation through fleet management tooling or Google Chrome Browser Cloud Management. As a compensating control where patching is not immediately feasible, WebGL can be disabled via Chrome enterprise policy (DisableWebGL) or the chrome://flags/#disable-webgl flag - note this breaks hardware-accelerated graphics for legitimate WebGL applications (maps, games, 3D viewers), causing functional degradation for end users. No network-layer mitigation can block this attack as the exploit payload is delivered via ordinary HTTPS web content.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today