EUVD-2026-50840
GHSA-998q-hx29-hhcp
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted HTML page with mandatory active user navigation (UI:R); memory leakage justifies C:H with no integrity or availability impact whatsoever.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Chromium's cross-platform OpenGL ES translation layer, converting graphics API calls to platform-native backends such as Direct3D (Windows), Metal (macOS), and Vulkan. CWE-457 (Use of Uninitialized Variable) arises when memory is allocated but not zeroed or initialized before use, potentially exposing residual data from prior memory allocations or heap contents. In this case, a crafted HTML page can trigger specific graphics operations through ANGLE that access uninitialized memory regions, causing those contents to be accessible to attacker-controlled script. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome versions across all platforms are affected prior to the patched release, as catalogued under EUVD-2026-50840.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later - this is the vendor-released patch as confirmed by the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically updates automatically, but administrators managing enterprise fleets should verify deployment via Group Policy or MDM tooling and confirm the installed version is 151.0.7922.72 or higher. As a compensating control prior to patching for high-risk users (e.g., executives, privileged accounts), enforcing browser isolation or restricting access to untrusted external web content through a secure web gateway can reduce exposure, at the cost of limiting general browsing functionality. Disabling WebGL or hardware-accelerated graphics via Chrome flags (--disable-gpu, --use-gl=swiftshader) may also reduce ANGLE attack surface but will degrade rendering performance noticeably.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today