Description
Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An uninitialized use bug in the ANGLE graphics library within Chrome enabled a remote attacker to read cross‑origin data from a crafted HTML page. This flaw allows unauthorized disclosure of information from web pages that do not share the same origin, resulting in a data breach without providing code execution capabilities.

Affected Systems

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability resides in the ANGLE component and is addressed in Chrome 149.0.7827.53 and later releases.

Risk and Exploitability

The flaw can be exploited by hosting a malicious web page that the victim loads in Chrome. Because the attack requires only a crafted page, the likely vector is a user visiting a site or clicking a link. The EPSS score is < 1%, and the CVSS score of 6.5 indicates a Medium severity, meaning the impact is significant on confidentiality. This vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on June 7, 2026 at 15:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 149.0.7827.53 or later
  • Enable automatic updates to receive future security patches
  • If updating is not immediately possible, launch Chrome with the flag --disable-angle to avoid using the vulnerable ANGLE component
  • Apply a strict Content Security Policy (CSP) that restricts cross‑origin data sharing to mitigate data leakage
  • For web developers, ensure that all data passed to the graphics pipeline is properly validated and initialized, preventing use of uninitialized or partially initialized memory as defined by CWE‑125, CWE‑457, and CWE‑787

Generated by OpenCVE AI on June 7, 2026 at 15:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Uninitialized Use in ANGLE
Weaknesses CWE-824
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 05 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Title Uninitialized Use in ANGLE Causing Cross‑Origin Data Leak in Google Chrome

Fri, 05 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CWE-787
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 04:30:00 +0000

Type Values Removed Values Added
Title Uninitialized Use in ANGLE Causing Cross‑Origin Data Leak in Google Chrome

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-457
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T16:30:24.605Z

Reserved: 2026-06-04T17:06:47.773Z

Link: CVE-2026-11090

cve-icon Vulnrichment

Updated: 2026-06-05T14:02:55.934Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:13.930

Modified: 2026-06-08T14:34:38.267

Link: CVE-2026-11090

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11090 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T15:30:04Z

Weaknesses