Executive brief
A security vulnerability in Google Chrome's graphics engine could allow a malicious website to access sensitive data from other websites you have open. This occurs because the browser fails to properly clear memory before using it, potentially exposing private information like login tokens or personal details. Users should update their browser to the latest version to prevent this cross-site data leakage.
Technical details
A vulnerability classified as 'Use of Uninitialized Variable' (CWE-457) exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome. The flaw allows a remote attacker to bypass cross-origin resource sharing (CORS) protections by enticing a user to visit a specially crafted HTML page. By exploiting uninitialized memory during graphics rendering, the attacker can read data belonging to other origins (sites) that should be isolated. This issue was addressed in Chrome version 148.0.7778.216 and later. Google has assigned this a 'High' severity rating.
Affected products
- Google Chrome Prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released for Windows, Mac, and Linux.
- 2026-05-28: disclosed: CVE published to the NVD.