EUVD-2026-93801
GHSA-39w9-4hv7-rqhm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger uninitialized resource in ANGLE
-
ExecutionRead memory outside sandbox
-
ImpactExfiltrate leaked data to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires a user running Google Chrome prior to 155.0.8059.39 on Windows to open or be redirected to an attacker-crafted HTML page that exercises the ANGLE (OpenGL ES abstraction) code path containing the uninitialized resource. No authentication is required (PR:N), but the mandatory user interaction (UI:R) of visiting the page is the primary limiting factor, as is the version/platform scope (patched builds and non-Windows platforms are out of scope per the provided data). Impact is limited to reading memory across the sandbox boundary (C:L, no integrity or availability impact), so by itself it leaks information rather than granting code execution. |
| Impact | Signals are consistent and point to a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base 4.7) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (visiting a crafted page) and yields only limited confidentiality impact (memory read) with no integrity or availability effect. Google's internal 'High' Chromium severity rating reflects that this is a sandbox-boundary information leak (CWE-908, uninitialized resource in ANGLE), which is valued as a building block in exploit chains more than as a standalone compromise. The EPSS score is low (0.24%, 13th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified - so there is no public exploit identified at time of analysis. The main tension is between Google's 'High' internal rating and the comparatively low 4.7 CVSS / low EPSS: this is normal for Chrome info-leaks, which are rated highly because of chainability yet score low in isolation. A patch is available (155.0.8059.39), making this a routine-priority browser update rather than a drop-everything event. |
| Exploit ScenarioDerived | A remote attacker hosts or compromises a web page containing specially crafted content that triggers the uninitialized-resource flaw in Chrome's ANGLE graphics layer when the victim visits it. Because the CVSS scope is changed (S:C), the attacker reads memory from outside the renderer sandbox, potentially leaking sensitive data or addresses usable to defeat ASLR in a larger chain. No public proof-of-concept is identified at time of analysis, and successful exploitation requires the victim to open the malicious page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Information disclosure in Google Chrome on Windows lets remote attackers read memory outside the browser sandbox by convincing a user to open a crafted HTML page that exercises the ANGLE graphics translation layer. The affected builds are Chrome versions prior to 155.0.8059.39 on Windows; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) confirms no authentication is required but that a victim must interact with the malicious page, and the Scope:Changed rating reflects that the read crosses the intended sandbox boundary even though there is no integrity or availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.24% (13th percentile), consistent with a moderate-priority defect that is patched by the vendor.
RemediationAI
Vendor-released patch: 155.0.8059.39 - upgrade Google Chrome on Windows to 155.0.8059.39 or later, which is delivered automatically through Chrome's stable channel updater; verify the running build via chrome://version and confirm the fleet has moved past the vulnerable floor (tracked per the advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html). Until upgrade completes, the practical compensating controls are to force browser restarts so pending updates actually apply, and in high-risk managed environments to reduce exposure to unknown canvas/WebGL content via enterprise URL filtering or disabling WebGL (chrome://flags or the corresponding enterprise policy), accepting the trade-off of broken or degraded 3D content, mapping, and web-app rendering. Restricting local administrative control over GPU flags is not a reliable mitigation because the attack path is page-driven, so update enforcement remains the primary defense; there is no indication of active exploitation to justify emergency out-of-band measures.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a use of an uninitialized resource (CWE-908) in ANGLE, Chromium's Almost Native Graphics Layer Engine, which translates OpenGL ES API calls into platform-native backends such as Direct3D 11 on Windows. When a crafted HTML page drives a canvas/WebGL path into code that consumes a graphics resource (buffer, texture, or descriptor) before it has been fully initialized, uninitialized contents can be surfaced to the renderer and, per the Scope:Changed vector (S:C) and description, read outside the sandbox, turning a graphics-stack hygiene bug into a cross-boundary memory disclosure. The affected component is the Google Chrome application on Windows only, captured by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the patched floor at 155.0.8059.39; the flaw is not reported as affecting macOS or Linux Chrome builds. Because the impact is limited to confidentiality (C:L) with no integrity or availability effect, this is an information-leak primitive rather than a code-execution chain unless paired with a separate second-stage exploit.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Network-delivered crafted page needs a victim visit (AV:N, UI:R, PR:N); the sandbox-boundary read changes scope (S:C) and leaks data only (C:L, I:N, A:N).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB