EUVD-2026-50809
GHSA-3wgm-hxjc-v3w2
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N and PR:N because only a crafted web page visit is required; UI:R for mandatory victim navigation; C:H for renderer process memory exposure; S:U confirms no sandbox escape; I:N and A:N as no write or denial-of-service impact exists.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction layer that translates OpenGL ES API calls to platform-native rendering APIs (DirectX on Windows, Metal on macOS, Vulkan where supported). An inappropriate implementation within ANGLE - classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - causes the subsystem to improperly handle memory in a way that allows contents of the renderer process to be read by attacker-controlled web content. The vulnerability is scoped to the renderer process (S:U in CVSS, no sandbox escape), limiting but not eliminating the sensitivity of potentially disclosed data. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, per the vendor-released patch confirmed by the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome updates automatically, but users must fully restart the browser after the update is downloaded for it to take effect - verify the installed version under chrome://settings/help. For environments where immediate restart is not feasible, restrict navigation to untrusted or external websites as a temporary compensating control; this reduces exposure but does not eliminate it if trusted sites are compromised. Enterprise deployments using Chrome via managed policies should push the update through their endpoint management platform and enforce browser restart via policy to close the remediation gap.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today