EUVD-2026-89383
GHSA-hqh7-8254-79g9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits attacker-controlled web page
-
ExploitPage issues crafted WebGPU allocation/read
-
ExecutionRead returns uninitialized GPU memory
-
ImpactExfiltrate leaked cross-origin data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Requires the victim to visit an attacker-controlled web page (UI:R) in Chrome versions prior to 154.0.8037.92, and requires the WebGPU feature to be reachable/enabled (WebGPU is available by default on supported hardware/OS in modern Chrome). Exploitation is unauthenticated and remote but limited to leaking small amounts of uninitialized memory as cross-origin data - there is no code execution, no write primitive, and no availability impact. Limiting factors: mandatory user interaction, dependence on WebGPU being active on the victim's platform/GPU, and low information yield per SSVC Technical Impact=partial. |
| Impact | This is a genuinely low real-world priority despite Chrome's ubiquity and Chromium's internal 'High' label. The signals are consistent and point downward: NVD CVSS 3.1 is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) - confidentiality-only, LOW impact, no integrity or availability effect, requiring user interaction (visiting a crafted page). SSVC reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no, Technical Impact=partial. There is no EPSS score, no CISA KEV listing, and no public PoC identified. The disconnect worth noting: Chromium's 'security severity: High' reflects the class of bug (uninitialized-memory cross-origin read in WebGPU) and its potential to leak sensitive cross-origin data, whereas the NVD/CVSS 4.3 reflects the constrained, low-volume nature of the actual leak (C:L, no code execution). This is an information-disclosure primitive, not an RCE - unlike the same-build sibling CVE-2026-102304 (UAF, 9.6, RCE). Treat as a routine 'patch on next Chrome update' item, not an emergency. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGPU shader/buffer operations that trigger a read of uninitialized GPU resource memory. When a victim visits the page, the page reads back uninitialized memory that may contain residual cross-origin pixel or buffer data, leaking small amounts of information across the same-origin boundary. No public exploit code has been identified and exploitation is not automatable per SSVC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Uninitialized memory in Google Chrome's WebGPU implementation, in builds prior to 154.0.8037.92, can be read back by a remote attacker as cross-origin data when a victim loads a crafted HTML page. The flaw is unauthenticated and remote (CVSS:3.1/AV:N/AC:L/PR:N) but demands that the victim visit the attacker-controlled page (UI:R) and that WebGPU is reachable on the target platform; the outcome is a limited information disclosure with no code execution, no write primitive, and no availability impact, which is why the CVSS 3.1 base score is only 4.3 despite Chromium's internal 'High' severity label. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a genuinely low real-world priority even given Chrome's ubiquity.
RemediationAI
The primary fix is to update Google Chrome to version 154.0.8037.92 or later, which is the vendor-released patch for this issue; the simplest path is the built-in updater via chrome://settings/help (or chrome://help), followed by a full browser restart, since Chrome will not apply a newly staged version until the process is relaunched. Enterprise administrators should validate that managed update policies allow the browser to reach 154.0.8037.92 and force a relaunch during the next maintenance window; the details are in the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html, with the technical report at https://issues.chromium.org/issues/560062638. If immediate updating is not possible, the only meaningful compensating control is to remove the attack surface by disabling WebGPU, either per device through the Chrome flags UI or by blocking access to WebGPU-exposing sites for high-risk user groups - the trade-off is that this breaks or degrades GPU-accelerated web apps, 3D content, and on-device machine-learning features, and flag-based disabling must be reapplied across fleets and can be reset by users or upgrades, so it should be treated as a stopgap rather than a substitute for the patch. Given the low CVSS base score (4.3), the read-only nature of the leak, the requirement for user interaction, and the absence of any observed exploitation or public exploit code, this should be scheduled as a routine update rather than an emergency remediation; there is no need for network-level blocking or browser isolation as a response to this CVE alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-908 (Use of Uninitialized Resource), here applied to WebGPU, the modern browser API that exposes GPU compute and rendering pipelines to JavaScript. GPU allocations are often recycled, so a resource that is handed to a page before being fully initialized can expose residual bytes left behind by a previous allocation - potentially data belonging to another origin - turning what looks like a memory hygiene bug into a same-origin-policy bypass. The reported impact is read-only: a crafted HTML page can pull small amounts of uninitialized memory out as cross-origin data, with no corruption, write primitive, or availability effect, which matches the assessed vector (C:L, I:N, A:N, S:U) and the SSVC appraisal of Technical Impact = partial, Exploitation = none, Automatable = no. Exposure depends on WebGPU actually being active, which is the default on supported hardware and operating systems in modern Chrome builds, so the practical attack surface is narrower than the browser's installed base but not negligible. The provided CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, carries no version bounds and therefore only tells us the affected component family (Google Chrome) rather than a precise vulnerable build set; the authoritative version boundary comes from the description and EUVD data, both of which point at 154.0.8037.92 as the fixing build. The upstream Chromium issue (560062638) and the Chrome Releases stable-channel advisory are the primary sources for the fix.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page requires no privileges but needs a victim visit (UI:R); uninitialized-memory read yields limited cross-origin disclosure (C:L) with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB