Executive brief
A vulnerability exists in Google Chrome's ANGLE component, which handles graphics processing. An attacker who has already partially compromised the browser's rendering process could use this flaw to steal sensitive data from other websites the user has open. This could lead to the exposure of private information through a specially crafted web page.
Technical details
An uninitialized use vulnerability (CWE-457) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw allows a remote attacker who has already compromised the renderer process to bypass cross-origin resource sharing (CORS) protections. By enticing a user to visit a malicious HTML page, the attacker can exploit the uninitialized variable to leak sensitive data from other origins. This issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome version 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published.