EUVD-2026-50759
GHSA-7hvm-x3c6-5694
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted WebGPU HTML page
-
DeliveryVictim clicks link and loads page in unpatched Chrome
-
ExploitDawn processes WebGPU calls triggering uninitialized memory read
-
ExecutionCross-origin memory contents exposed to attacker JavaScript
-
ImpactAttacker exfiltrates leaked data to remote server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72 on a desktop platform and must actively visit (or be redirected to) an attacker-controlled HTML page - user interaction is required (UI:R per CVSS). No authentication, special server-side configuration, or elevated privileges are needed on the attacker's side. WebGPU support must be active in the browser, which is the default for affected Chrome versions; disabling WebGPU via policy removes the attack surface. Exploitation is limited to confidentiality impact only (no code execution, no integrity or availability consequences), and Chrome's renderer sandbox constrains which cross-origin data is reachable. The flaw does not affect Chromium-based browsers on separate release tracks (e.g., Edge, Brave) unless they incorporate the same unpatched Dawn revision. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N and score of 4.3 accurately represent the risk envelope: the flaw is network-reachable with low complexity but mandates user interaction and delivers only limited confidentiality impact with no integrity or availability consequence. The EPSS probability of 0.23% (14th percentile) places this in the bottom quintile of exploitation likelihood, consistent with the absence of CISA KEV listing and no known public proof-of-concept code. This is a genuine privacy concern - cross-origin leakage can expose authentication tokens or sensitive page content - but it does not approach the severity of a remote code execution or sandbox escape. Real-world prioritization should be moderate: patch as part of the regular Chrome update cycle, but no emergency response is warranted for organizations without unusually sensitive cross-origin browser workloads. |
| Exploit ScenarioDerived | An attacker crafts an HTML page containing WebGPU API calls designed to trigger Dawn's uninitialized memory path, then lures a victim (via phishing link or malvertising) into visiting the page in a vulnerable Chrome browser. The malicious JavaScript reads the leaked memory contents and exfiltrates them to an attacker-controlled server, potentially exposing session tokens, page fragments, or other sensitive data from cross-origin contexts loaded in the same browser process. No public exploit code has been identified, but the low-complexity, network-accessible nature of the flaw makes exploitation technically feasible for a skilled attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. No public exploit has been identified at time of analysis and the EPSS score of 0.23% (14th percentile) reflects a currently low exploitation likelihood, consistent with Chromium's own Medium severity rating.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism handles this for consumer installations; enterprise administrators should validate deployment status via chrome://settings/help or their endpoint management tooling. If immediate patching is blocked, restricting end-user access to untrusted or unknown web origins via network proxy policy or browser extension controls reduces exposure to the crafted-page delivery vector, though this is not a full mitigation and carries usability trade-offs. Disabling WebGPU entirely via enterprise policy (--disable-webgpu flag or corresponding GPUEnabled policy) would eliminate the Dawn attack surface but also breaks WebGPU-dependent web applications.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is Chromium's cross-platform WebGPU graphics abstraction layer, responsible for translating WebGPU API calls into native GPU commands (via Metal, Vulkan, or D3D12). CWE-457 (Use of Uninitialized Variable) arises when allocated memory buffers are consumed before being zeroed or explicitly set, potentially exposing residual heap or stack contents from earlier allocations. In this context, a crafted HTML page can cause Dawn to process a WebGPU operation that reads uninitialized memory whose contents originate from a different browser origin, violating the Same-Origin Policy and constituting an information disclosure channel. The affected scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds prior to 151.0.7922.72 across platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), no auth needed (PR:N), active user visit required (UI:R), limited data leak with no integrity or availability impact (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB