EUVD-2026-50793
GHSA-g875-cphx-rv8q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML with WebGL payload
-
DeliveryVictim navigates to attacker-controlled URL
-
ExploitChrome renders page through ANGLE graphics layer
-
ExecutionUninitialized memory read triggered in ANGLE code path
-
PersistResidual cross-origin data exposed to page script
-
ImpactAttacker JavaScript collects and exfiltrates leaked data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation requires that the victim uses a Google Chrome desktop installation prior to version 151.0.7922.72 and actively navigates to an attacker-controlled HTML page - the CVSS UI:R (user interaction required) gate means passive drive-by delivery without navigation is not feasible, consistent with SSVC's 'Automatable: no' rating. The vulnerability is exercised through Chrome's ANGLE graphics rendering path; no special browser configuration, extension, or non-default setting is required beyond the victim loading the page. The CVSS PR:N metric confirms the attacker requires no authentication or privileges on any system. The S:U (Unchanged scope) scope means exploitation is bounded within the Chrome renderer sandbox and cannot directly compromise the underlying OS. Chrome's Site Isolation further limits what cross-origin memory is co-resident in the vulnerable process, reducing the set of data a successful exploit can reach. |
| Impact | The CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) captures the core risk profile: network-reachable, low complexity, no authentication required, but gated by mandatory user interaction (victim must navigate to the attacker's page). The high confidentiality rating reflects that cross-origin data - potentially session tokens, page content, or user data from co-resident origins - could be exposed. However, multiple threat intelligence signals align to temper urgency: EPSS at 0.31% (24th percentile) is notably low, SSVC rates exploitation as 'none' and the attack as non-automatable, and the vulnerability is absent from CISA KEV. The S:U (Unchanged scope) confirms sandbox containment - this does not enable OS-level compromise. The combined picture is a real but currently theoretical confidentiality risk that warrants prompt patching in standard update cycles, without requiring emergency out-of-band response. No signal conflicts exist in the available data. |
| Exploit ScenarioDerived | An attacker publishes a crafted HTML page containing WebGL or graphics API calls engineered to trigger the uninitialized memory path within ANGLE's rendering pipeline. A victim using unpatched Chrome navigates to the page - via phishing link or malicious advertisement - causing ANGLE to read and expose uninitialized memory that may contain residual cross-origin data, which the page's JavaScript collects and exfiltrates to an attacker-controlled server. No public proof-of-concept has been identified at time of analysis, and SSVC confirms the attack is not automatable, requiring deliberate user navigation to the malicious resource. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch resolving the uninitialized memory use in ANGLE; this is the primary and definitive fix per the Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's auto-update mechanism deploys this fix automatically for most consumer installations; enterprise administrators should accelerate delivery via Group Policy (ExtensionInstallForcelist/Chrome Browser Cloud Management) and confirm version deployment. As a compensating control pending patch rollout, enforcing Site Isolation (already the default in modern Chrome via --site-per-process) limits cross-origin memory co-residency within a single renderer process, reducing the practical leakage surface - however, it does not eliminate the underlying uninitialized memory defect. Restricting user navigation to untrusted external sites through web proxy allowlisting is an additional defensive layer at the cost of user workflow friction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Chrome's open-source graphics abstraction layer that translates OpenGL ES API calls to platform-native graphics APIs - DirectX on Windows, Metal on macOS, and Vulkan across platforms. CWE-457 (Use of Uninitialized Variable) indicates that a code path within ANGLE processes memory before it has been properly initialized. In a browser graphics context, uninitialized GPU or CPU-side memory buffers may contain residual data from prior rendering operations, potentially including content from cross-origin frames or tabs rendered in the same process. An attacker-controlled page can craft WebGL or graphics API interactions to trigger this code path and observe the leaked memory contents. The affected product scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 151.0.7922.72 as confirmed by EUVD-2026-50793.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted web page, no authentication required (PR:N), victim must actively navigate (UI:R); high confidentiality from cross-origin data exposure with no integrity or availability impact, sandbox-contained (S:U).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB