EUVD-2026-50872
GHSA-wh5x-xgmx-5f4c
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory prerequisite of prior renderer process compromise; remaining metrics unchanged as the disclosure itself is network-delivered and user-triggered with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.
Technical ContextAI
Dawn is Google's open-source implementation of the WebGPU API, embedded in Chrome for GPU-accelerated graphics and compute workloads. CWE-457 (Use of Uninitialized Variable) identifies the root cause: a memory region within Dawn is read before being properly initialized, exposing whatever data previously occupied that address - a classic information disclosure primitive. In Chrome's multi-process architecture, the renderer process handles page parsing and JavaScript execution inside a sandbox; Dawn operations execute within that renderer context. The uninitialized read is reachable through crafted HTML triggering WebGPU operations. The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds across platforms prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this vulnerability as confirmed by the Chrome Releases stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organizations unable to patch immediately, note that exploitation requires a prior renderer process compromise: ensuring Chrome's built-in sandbox is not disabled (e.g., do not run Chrome with --no-sandbox in production) is the primary compensating control, as the sandbox is the barrier that prevents the prerequisite stage. Disabling WebGPU via enterprise policy or the --disable-gpu flag would eliminate the Dawn attack surface entirely but may break WebGPU-dependent web applications - this trade-off is acceptable in high-security environments. No workaround supersedes applying the patch.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today