EUVD-2026-89376
GHSA-rrvf-gg94-j22j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits crafted HTML page
-
DeliveryPage issues malicious WebGL/graphics calls
-
ExploitANGLE uses uninitialized resource
-
ExecutionRead memory outside sandbox
-
ImpactExfiltrate leaked memory contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires a user to open or be redirected to attacker-controlled HTML in a vulnerable Chrome build (<154.0.8037.92) on Windows that exercises the ANGLE graphics path (WebGL/GPU-accelerated content). Limiting factors: user interaction is mandatory (UI:R - the victim must load the page), the impact is confined to a low-severity memory read (C:L, no write/RCE on its own), it is platform-specific to Windows, and a fixed version is already published, so patched or auto-updated installations are not exposed. |
| Impact | Signals are consistent and point to a genuine but LOW-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N = 4.7 Medium) describes a remote, unauthenticated, low-complexity attack requiring user interaction (visiting a crafted page), with a scope change (S:C, reflecting a read that crosses the renderer sandbox boundary) but only LOW confidentiality impact and no integrity or availability impact. There is a notable severity divergence: Chromium rates this 'High' internally while NVD scores it 4.7 Medium - the gap is explained by the impact being a bounded memory-read/info-leak (CWE-908 uninitialized resource in ANGLE) rather than code execution. No EPSS score, no CISA KEV listing, and no public exploit are provided; exploitation status is 'no public exploit identified at time of analysis.' No SSVC data was supplied. A vendor patch is available. Net: real and worth patching in the normal cadence, but this is a high-internal-severity/low-real-world-risk info-disclosure primitive, typically valuable only as one link in a multi-bug exploit chain rather than a standalone priority. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page that drives Chrome's ANGLE (OpenGL ES-to-native graphics translation) layer into using an uninitialized resource, causing the renderer to read adjacent process memory outside the intended sandbox-managed allocation. The leaked bytes (e.g., pointers or cross-origin data) could be exfiltrated to defeat ASLR or aid a paired memory-corruption bug. No public exploit is identified, and user interaction (visiting the page) is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Uninitialized resource handling in ANGLE, the GPU translation layer bundled with Google Chrome on Windows, lets a remote attacker who gets a victim to load a crafted HTML page trigger a memory read that crosses the browser's sandbox boundary, although the leak is limited to low-severity confidentiality impact (CVSS 4.7, C:L, S:C with no integrity or availability effect). Only Chrome builds on Windows prior to 154.0.8037.92 are affected; the attack is unauthenticated per the CVSS vector but requires user interaction (UI:R) - the victim must open or be redirected to attacker-controlled content that exercises the WebGL/GPU-accelerated path. No public exploit code identified at time of analysis, no confirmed active exploitation (CISA KEV), and Google has already published a fixed build, so the practical risk is low.
RemediationAI
Vendor-released patch: Google Chrome 154.0.8037.92 (Windows stable channel), which is the primary and complete fix - update to that build or later and fully restart the browser so the new GPU/renderer processes load the patched ANGLE library, then verify the installed version at chrome://version. Because Chrome auto-updates by default, most installations will be remediated without operator action; environments that pin browser versions should push 154.0.8037.92 through their update mechanism, and Microsoft-tagged Chromium derivatives such as Edge need their corresponding upstream build. No vendor workaround is documented, and the only meaningful interim mitigations are blunt: launch Chrome with --disable-gpu or disable the WebGL/WebGL2 features via chrome://flags to remove the ANGLE code path from reach - with the clear trade-off of breaking WebGL content and degrading rendering performance and battery life for all users - or restrict browsing to trusted sites until the update lands, which addresses the UI:R prerequisite but is not enforceable at scale. Reference advisories: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html and https://issues.chromium.org/issues/556789073.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-908 uninitialized resource bug in ANGLE (Almost Native Graphics Layer Engine), the OpenGL ES / WebGL translation layer Chrome uses on Windows to map WebGL calls onto Direct3D. When a crafted HTML page drives the graphics pipeline, ANGLE uses a resource (buffer, texture or shader-related allocation) before it has been fully initialized, so stale memory contents can be observed by the attacker. The CVSS vector scores scope change (S:C) with low confidentiality impact, reflecting the description's claim that the read can reach memory outside the renderer sandbox - the memory disclosure therefore crosses a privilege boundary even though it does not on its own yield code execution, data modification or denial of service. Exploitation is platform-specific (Windows ANGLE/D3D backend) and gated on user interaction: PR:N means no credentials are needed, but UI:R means the victim must load the attacker-controlled page for the bug to be reached. The associated CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* is platform-agnostic in ITS form, so the Windows-only scope comes from the vendor description rather than the CPE string.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Remote crafted page needs no auth but requires the victim to load it (UI:R); reading memory across the sandbox boundary is a scope change (S:C) with a bounded low-confidentiality leak and no integrity/availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB