EUVD-2026-50815
GHSA-9pfc-5g23-v3x7
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AV:N for web-delivered attack, UI:R for mandatory victim navigation, C:L for bounded cross-origin data leak only; no integrity or availability impact applies.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer embedded in Google Chrome that translates OpenGL ES API calls to platform-native graphics APIs such as Direct3D on Windows, Metal on macOS, and Vulkan. CWE-457 (Use of Uninitialized Variable) describes a class of memory safety bugs where allocated memory is read before being explicitly initialized, allowing residual or stale memory contents - potentially from adjacent or prior allocations - to be observed. In this case, uninitialized state within ANGLE's graphics pipeline is reachable via a crafted HTML page, likely through WebGL or canvas operations that invoke a code path where memory is not zeroed before use. This can expose memory contents belonging to a different web origin, breaking the Same-Origin Policy at the graphics subsystem level. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome variants prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; enterprise administrators should verify deployment via Chrome Browser Cloud Management or equivalent policy tooling and confirm version compliance across managed endpoints. No documented workarounds exist for this ANGLE-level flaw short of disabling WebGL (via the '--disable-webgl' flag or enterprise policy 'WebGLEnabled: false'), which prevents many sites from rendering correctly and should be treated as a disruptive last resort. The upstream Chromium issue is tracked at https://issues.chromium.org/issues/517045160. Chromium-derivative browser vendors should assess and apply equivalent upstream patches.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today