CVE-2026-14386 - Vulnerability Details

Description

Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Published: 2026-07-01

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out‑of‑bounds read occurs in the ANGLE graphics layer of Google Chrome, permitting a remote attacker to read memory from the browser process when a carefully crafted HTML page is rendered. The data that may be exposed is potentially sensitive information stored in process memory. The flaw is identified as CWE‑125 and was considered high severity by Chromium security.

Affected Systems

All users running a Google Chrome build prior to version 150.0.7871.46 on any supported operating system are affected, because ANGLE is employed across desktop Chrome builds.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity, while an EPSS score of less than 1% suggests that exploitation is currently unlikely according to public threat feeds. The vulnerability is not listed in CISA’s KEV catalog. Attackers must deliver a malicious HTML page that a user chooses to visit; the attack relies entirely on the browser’s rendering engine to trigger the out‑of‑bounds read.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.46`	affected	< 150.0.7871.46

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[150.0.7871.46,150.0.7871.46)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to 150.0.7871.46 or later to eliminate the out‑of‑bounds read in ANGLE.
Configure Chrome Enterprise to enforce automatic updates so the fix is applied as soon as possible.
Implement a content‑security policy or web‑filtering mechanism to block untrusted HTML content from loading until the browser is patched.

Generated by OpenCVE AI on August 1, 2026 at 22:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00263.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/499047960

History

Sat, 01 Aug 2026 22:30:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Out‑of‑Bounds Read Enables Sensitive Information Disclosure

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in ANGLE Leading to Sensitive Information Disclosure

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in ANGLE Leading to Sensitive Information Disclosure

Wed, 22 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Title	Potential memory disclosure via ANGLE out‑of‑bounds read in Chrome

Fri, 17 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Title		Potential memory disclosure via ANGLE out‑of‑bounds read in Chrome

Tue, 14 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in ANGLE Allows Remote Information Disclosure

Sun, 12 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in ANGLE Allows Remote Information Disclosure

Sun, 12 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title	Chrome ANGLE Out-of-Bounds Read Enables Sensitive Information Disclosure via Crafted HTML

Fri, 10 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome ANGLE Out-of-Bounds Read Enables Sensitive Information Disclosure via Crafted HTML

Thu, 09 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in Chrome ANGLE Allows Remote Sensitive Data Leak

Wed, 08 Jul 2026 18:15:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in Chrome ANGLE Allows Remote Sensitive Data Leak

Tue, 07 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Out-of-Bounds Read Enables Sensitive Data Disclosure in Chrome

Tue, 07 Jul 2026 01:45:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Out-of-Bounds Read Enables Sensitive Data Disclosure in Chrome

Mon, 06 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Out-of-Bounds Read Enables Remote Information Disclosure

Sun, 05 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Out-of-Bounds Read Enables Remote Information Disclosure

Sun, 05 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Out-of-Bounds Read Enables Remote Data Leakage

Sat, 04 Jul 2026 21:30:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Out-of-Bounds Read Enables Remote Data Leakage

Sat, 04 Jul 2026 10:45:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Out-of-Bounds Read Allows Sensitive Information Disclosure in Chrome

Fri, 03 Jul 2026 22:15:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Out-of-Bounds Read Allows Sensitive Information Disclosure in Chrome

Fri, 03 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Read in ANGLE Permits Remote Leakage of Browser Process Memory

Fri, 03 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Read in ANGLE Permits Remote Leakage of Browser Process Memory

Fri, 03 Jul 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Read in ANGLE Permits Remote Information Disclosure in Chrome

Thu, 02 Jul 2026 16:00:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Read in ANGLE Permits Remote Information Disclosure in Chrome

Thu, 02 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in ANGLE Enabling Remote Retrieval of Process Memory

Thu, 02 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Thu, 02 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in ANGLE Enabling Remote Retrieval of Process Memory

Thu, 02 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		Out of bounds read in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Weaknesses		CWE-125
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/499047960

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-07-01T22:21:52.250Z

Updated: 2026-07-02T00:34:42.907Z

Reserved: 2026-07-01T21:37:24.890Z

Link: CVE-2026-14386

Vulnrichment

Updated: 2026-07-02T00:34:38.641Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-01T22:30:06Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object