EUVD-2026-50927
GHSA-j7jv-4f3j-j984
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery via crafted page, no privileges needed, user must visit page (UI:R); only confidentiality impacted as the flaw yields a memory read with no write or crash primitive.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.
Technical ContextAI
WebGL (Web Graphics Library) is a browser-embedded JavaScript API exposing OpenGL ES 2.0/3.0 GPU functionality directly to web pages without plugins. Chrome's implementation routes WebGL calls through the GPU process sandbox. The flaw is classified as an 'inappropriate implementation' - meaning Chrome's logic around WebGL state management or memory handling violates expected security invariants, allowing cross-boundary reads of process memory that should be inaccessible to the rendering context. No CWE is formally assigned, but the behaviour aligns with CWE-125 (Out-of-bounds Read) or CWE-200 (Exposure of Sensitive Information) patterns common in graphics-driver bridging code. Affected CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Help > About Google Chrome) or through enterprise software distribution. The patch is confirmed available per the Chrome stable channel release blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For organisations that cannot immediately update, a compensating control is to disable WebGL via enterprise policy (ChromeWebGLEnabled = false or WebGLEnabled policy set to disabled); note this will break WebGL-dependent web applications and may affect productivity for users of CAD, mapping, or 3D visualisation tools. Alternatively, restricting navigation to untrusted external sites via URL filtering reduces exposure. Enterprise administrators should prioritise rollout within the normal patch cycle rather than treating this as a break-glass event given the low EPSS and absence of active exploitation.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today