CVE-2026-14402 - Vulnerability Details

Description

Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Published: 2026-07-01

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Uninitialized variable usage (CWE-457) in the ANGLE graphics library of Google Chrome for Windows allows memory disclosure through a specially crafted HTML page, potentially exposing confidential or proprietary data that the victim process can access.

Affected Systems

Google Chrome for Windows versions earlier than 150.0.7871.46 are vulnerable. The issue originates in the ANGLE component and affects all affected releases on Windows platforms.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium‑high severity, while the EPSS score of < 1% suggests a very low current probability of exploitation. The vulnerability is not listed in CISA's KEV catalogue. Based on the description, it is inferred that the likely attack vector involves a remote attacker delivering malicious HTML content to the victim over the internet, after which the flaw permits memory disclosure. Although the exploitation likelihood remains low, the potential for widespread impact in web‑driven scenarios warrants timely remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.46`	affected	< 150.0.7871.46

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[150.0.7871.46,150.0.7871.46)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Google Chrome to version 150.0.7871.46 or later to receive the ANGLE uninitialized‑variable fix.
Configure Chrome Management in enterprise environments to enforce automatic updates for all Chrome installations.
Monitor browser activity or network traffic for indicators of malicious HTML content to detect exploitation attempts.

Generated by OpenCVE AI on July 21, 2026 at 12:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00224.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/513051340

History

Tue, 21 Jul 2026 13:15:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Variable in ANGLE Enables Remote Memory Disclosure on Windows Chrome

Fri, 17 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Variable in ANGLE Enables Remote Memory Disclosure on Windows Chrome

Wed, 15 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
Title	ANGLE uninitialized variable enables memory disclosure via crafted HTML in Chrome

Mon, 13 Jul 2026 23:30:00 +0000

Type	Values Removed	Values Added
Title		ANGLE uninitialized variable enables memory disclosure via crafted HTML in Chrome

Mon, 13 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Variable in ANGLE Enables Memory Disclosure in Chrome for Windows

Sun, 12 Jul 2026 01:15:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Variable in ANGLE Enables Memory Disclosure in Chrome for Windows

Sat, 11 Jul 2026 07:30:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Variable Usage in ANGLE Enables Remote Memory Disclosure in Chrome Windows

Fri, 10 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Variable Usage in ANGLE Enables Remote Memory Disclosure in Chrome Windows

Thu, 09 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Uninitialized Use Allows Remote Information Disclosure in Chrome on Windows

Thu, 09 Jul 2026 02:15:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Uninitialized Use Allows Remote Information Disclosure in Chrome on Windows

Wed, 08 Jul 2026 07:30:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Uninitialized Variable Exploitation Enables Remote Memory Disclosure in Chrome for Windows

Tue, 07 Jul 2026 09:00:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Uninitialized Variable Exploitation Enables Remote Memory Disclosure in Chrome for Windows

Mon, 06 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Variable in ANGLE Enables Remote Information Disclosure in Chrome on Windows

Sun, 05 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Variable in ANGLE Enables Remote Information Disclosure in Chrome on Windows

Sun, 05 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Use in ANGLE Graphics Library Leading to Remote Information Disclosure

Sat, 04 Jul 2026 13:45:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Use in ANGLE Graphics Library Leading to Remote Information Disclosure

Sat, 04 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Uninitialized Use Exposes Sensitive Data via HTML in Chrome

Fri, 03 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Uninitialized Use Exposes Sensitive Data via HTML in Chrome

Fri, 03 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Use in ANGLE Leads to Remote Information Disclosure in Chrome on Windows

Thu, 02 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Use in ANGLE Leads to Remote Information Disclosure in Chrome on Windows

Thu, 02 Jul 2026 12:45:00 +0000

Type	Values Removed	Values Added
Title	Uninitialized Variable Use in ANGLE Leaking Process Memory

Thu, 02 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Thu, 02 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Title		Uninitialized Variable Use in ANGLE Leaking Process Memory

Thu, 02 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		Uninitialized Use in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
Weaknesses		CWE-457
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/513051340

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-07-01T22:21:57.886Z

Updated: 2026-07-02T00:32:25.504Z

Reserved: 2026-07-01T21:37:28.949Z

Link: CVE-2026-14402

Vulnrichment

Updated: 2026-07-02T00:32:20.375Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-21T13:00:04Z

Weaknesses

CWE-457
Use of Uninitialized Variable

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object