EUVD-2026-50793
GHSA-g875-cphx-rv8q
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted web page, no authentication required (PR:N), victim must actively navigate (UI:R); high confidentiality from cross-origin data exposure with no integrity or availability impact, sandbox-contained (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics abstraction layer that translates OpenGL ES API calls to platform-native graphics APIs - DirectX on Windows, Metal on macOS, and Vulkan across platforms. CWE-457 (Use of Uninitialized Variable) indicates that a code path within ANGLE processes memory before it has been properly initialized. In a browser graphics context, uninitialized GPU or CPU-side memory buffers may contain residual data from prior rendering operations, potentially including content from cross-origin frames or tabs rendered in the same process. An attacker-controlled page can craft WebGL or graphics API interactions to trigger this code path and observe the leaked memory contents. The affected product scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 151.0.7922.72 as confirmed by EUVD-2026-50793.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch resolving the uninitialized memory use in ANGLE; this is the primary and definitive fix per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism deploys this fix automatically for most consumer installations; enterprise administrators should accelerate delivery via Group Policy (ExtensionInstallForcelist/Chrome Browser Cloud Management) and confirm version deployment. As a compensating control pending patch rollout, enforcing Site Isolation (already the default in modern Chrome via --site-per-process) limits cross-origin memory co-residency within a single renderer process, reducing the practical leakage surface - however, it does not eliminate the underlying uninitialized memory defect. Restricting user navigation to untrusted external sites through web proxy allowlisting is an additional defensive layer at the cost of user workflow friction.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today