Executive brief
A vulnerability in Google Chrome's graphics engine could allow a malicious website to access data from other websites. This occurs when the browser fails to properly clear memory before use, potentially exposing sensitive information to an attacker if a user visits a specially crafted webpage. Users should update to the latest version of Chrome to mitigate this risk.
Technical details
An uninitialized use vulnerability (CWE-457) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw is triggered when the engine utilizes a variable or memory buffer that has not been properly initialized, potentially containing residual data from previous operations. A remote attacker can exploit this by enticing a user to visit a malicious HTML page, allowing the attacker to bypass cross-origin isolation and leak sensitive data from other origins. This issue was addressed in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Fixed in Chrome 149.0.7827.53 stable channel update.
- 2026-06-04: disclosed: CVE published to NVD.