EUVD-2026-50734
GHSA-g6w4-jmq8-gxgf
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network vector, no privileges, mandatory user page visit (UI:R), confined to browser process (S:U), only partial cross-origin memory disclosure (C:L); no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics translation layer that converts OpenGL ES calls to native platform APIs - DirectX on Windows, Metal on macOS, and Vulkan where available. CWE-457 (Use of Uninitialized Variable) indicates a code path in ANGLE reads a memory buffer before it is properly zeroed or populated, causing the renderer to operate on residual memory contents from prior graphics operations. In a browser security context this is particularly sensitive: graphics memory from one browsing context (e.g., a cross-origin iframe or previously visited site) could persist in GPU or CPU-side buffers and become readable by a different, attacker-controlled WebGL or canvas context. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch that resolves this vulnerability; the release advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update will handle this for most consumer installs; enterprise administrators should verify rollout completion via chrome://settings/help or applicable fleet management tooling. Where immediate patching is not feasible, disabling WebGL via Chrome enterprise policy (WebGLEnabled: false) or the --disable-webgl launch flag removes the primary attack surface since ANGLE is the WebGL rendering backend - the trade-off is that WebGL-dependent web applications will fail to render. Restricting access to untrusted external web content via proxy policy provides an additional compensating layer but does not address the root cause.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today