EUVD-2026-93798
GHSA-5jvg-6324-537m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage triggers uninitialized resource in ANGLE
-
ExecutionRead leaked cross-origin memory via script
-
ImpactExfiltrate sensitive cross-origin data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires the victim to actively open or navigate to an attacker-controlled crafted HTML page in a vulnerable Chrome build (prior to 155.0.8059.39) that renders content through the ANGLE graphics backend; no authentication or prior privileges are needed (PR:N). The key limiting factor is mandatory user interaction (UI:R) - the attacker cannot trigger it without the victim loading the page - and impact is bounded to confidentiality only (cross-origin data disclosure), with no integrity or availability effect. Because ANGLE is Chrome's default rendering translation layer, no non-default configuration is required. |
| Impact | This is a genuinely moderate, not high, real-world priority despite the Chromium 'High' security-severity label (which reflects the bug class, not operational risk). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) shows a network-reachable, low-complexity, unauthenticated flaw, but it requires user interaction (victim must open a crafted page), causes only low confidentiality impact (cross-origin data disclosure), and has no integrity or availability impact. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV and has no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent - there is no conflict between the CVSS vector and the description (both indicate remote, user-interaction-gated, read-only cross-origin leakage). The practical risk is information leakage (e.g., reading cross-origin pixel/memory data) rather than code execution or full account compromise, and it is already patched. Priority should be driven by Chrome's ubiquity and patch cadence rather than by any evidence of active or imminent exploitation. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page that triggers the uninitialized resource in Chrome's ANGLE graphics layer; when a victim visits it, uninitialized memory containing cross-origin data is exposed back to attacker-controlled script, leaking information the origin should not be able to read. No public exploit code is referenced in the available data, and the attack is gated on the victim actually opening the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Cross-origin information disclosure in Google Chrome's ANGLE graphics layer affects builds prior to 155.0.8059.39, letting a remote, unauthenticated attacker read limited data belonging to other origins when a victim loads an attacker-crafted HTML page. The bug is an uninitialized-resource flaw (CWE-908) that Chromium rates 'High' on its internal severity scale, but the CVSS 3.1 vector (4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confines impact to partial confidentiality loss and requires the victim to actively open the page. No public exploit identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) signal; a vendor-released patch, Chrome 155.0.8059.39, is available.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome to 155.0.8059.39 or later - Chrome 155.0.8059.39 is the fixed version identified in the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, and most installations can pick it up through the built-in updater (chrome://settings/help) followed by a full browser restart so the new renderer/GPU binaries load; managed fleets should push the corresponding Google Chrome 155.0.8059.39 package via their normal software-deployment channel and verify the reported version afterwards. Where immediate upgrade is not possible, the most directly effective compensating control is to reduce ANGLE's attack surface by disabling hardware acceleration in Chrome's system settings (or forcing software rendering through enterprise policy), which prevents GPU-accelerated ANGLE code paths from being exercised - the trade-off is materially degraded rendering and video performance and possible breakage of WebGL-dependent internal applications. Disabling WebGL for untrusted sites is a narrower alternative with less performance cost, but it will break legitimate 3D web apps and does not close every path into ANGLE. Restricting users to a curated set of sites and blocking browsing to untrusted pages lowers exposure given the required user interaction, though it is a policy control rather than a technical fix. Note that patched releases for Chromium-derived browsers depend on those vendors rebasing onto Chromium 155.0.8059.39 or later; until then apply the same rendering restrictions there.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses by default to map OpenGL ES and WebGL API calls onto a platform's native graphics stack (D3D on Windows, Metal on macOS, Vulkan/GL on Linux), so it sits in the rendering path of virtually every GPU-accelerated page and does not require any non-default configuration to be reachable. The assigned weakness, CWE-908 (Use of Uninitialized Resource), means a buffer or resource object is consumed before it has been initialized, allowing residual contents of previously used GPU/renderer memory to be surfaced into a web-accessible result - in this case cross-origin data. That class of defect is dangerous specifically because the leaked bytes are not attacker-supplied but inherited from other contexts, which is why the confidentiality scope is cross-origin rather than same-origin. The renderer's sandbox and site-isolation boundaries limit how much can be exfiltrated, and the CVSS vector confirms integrity and availability are untouched (I:N/A:N), with the only real exploitation hurdle being mandatory user interaction (UI:R) to load the malicious page in a vulnerable build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Remote crafted page with no privileges (AV:N/PR:N) but requires the victim to open it (UI:R); impact is limited cross-origin read, so C:L and I:N/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB