Executive brief
A vulnerability in Google Chrome's graphics engine (ANGLE) could allow a malicious website to access sensitive information from the browser's memory. By tricking a user into visiting a specially crafted webpage, an attacker could potentially view data belonging to other open tabs or the browser process itself. This issue has been resolved in the latest Chrome update.
Technical details
An uninitialized use vulnerability (CWE-457) exists in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome. The flaw is triggered when the browser processes a specially crafted HTML page, leading to the use of memory that has not been properly initialized. A remote, unauthenticated attacker can exploit this to read sensitive information from the browser's process memory. The vulnerability was fixed in Chrome version 150.0.7871.115 for Windows and Mac, and 150.0.7871.114 for Linux.
Affected products
- Google Chrome prior to 150.0.7871.115
Timeline
- 2026-05-26: other: Reported to Google
- 2026-07-08: patched: Fixed in stable channel update 150.0.7871.115
- 2026-07-08: advisory