CVE-2026-10994

chromium-browser: Uninitialized Use in ANGLE

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

Uninitialized use within the ANGLE graphics subsystem of Google Chrome allows a crafted HTML page to trigger the flaw and let a remote attacker read potentially sensitive data from the browser’s process memory. The weakness is identified as a CWE‑457 and CWE‑824 situation, leading to information disclosure.

Affected Systems

Google Chrome desktop browsers prior to version 149.0.7827.53 are affected. The flaw is exposed to any user who opens a malicious web page in the browser.

Risk and Exploitability

The CVSS score of 6.5 denotes a medium risk level, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that a user visit a crafted web page; no local privilege escalation or code execution is needed. The potential impact is the compromise of private data that a user may have loaded in the browser.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.53 or newer.
  • Enable automatic updates so Chrome receives security upgrades promptly.
  • If immediate update is not feasible, restrict access to untrusted web content or employ stricter site isolation settings.

Generated by OpenCVE AI on June 7, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
Debian DSA Debian DSA DSA-6534-1 webkit2gtk security update
History
Type Values Removed Values Added
Title chromium-browser: Uninitialized Use in ANGLE
Weaknesses CWE-824
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Uninitialized Use in ANGLE Allowing Memory Disclosure via Crafted HTML Page
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Uninitialized Use in ANGLE Allowing Memory Disclosure via Crafted HTML Page
Type Values Removed Values Added
Description Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-457
References
Earlier changes (2)
Weaknesses
  • CWE-457

    Use of Uninitialized Variable

  • CWE-824

    Access of Uninitialized Pointer

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 6, 2026, 4:46 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 6, 2026, 4:45 PM

JSON

Status
Modified
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 22, 2026, 8:10 PM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 2:00 PM

JSON