Executive brief
Google Chrome is a widely used web browser. A vulnerability in its graphics engine component, ANGLE, could allow a malicious website to access data from other websites you have open. This could lead to the exposure of sensitive information across different browsing sessions if a user visits a specially crafted webpage.
Technical details
A vulnerability classified as 'Use of Uninitialized Variable' (CWE-457) exists within the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to the use of uninitialized memory during graphics rendering operations. A remote, unauthenticated attacker can exploit this to bypass cross-origin resource sharing (CORS) protections and leak sensitive data from other origins. The issue is resolved in Google Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE-2026-11109 published