Description
Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is the uninitialized use of memory in the WebGL implementation of Google Chrome for Android. When a malicious page is rendered, the browser can read data that belong to other web origins, allowing a remote attacker to acquire sensitive information that should remain isolated. This is a classic instance of CWE‑457 (Uninitialized Variable) and CWE‑908 (Information Exposure).

Affected Systems

Chrome for Android users running versions earlier than 151.0.7922.72 are vulnerable. Those operating these builds are exposed until they upgrade to the fixed revision.

Risk and Exploitability

The CVSS score of 4.3 indicates a medium risk level, and the EPSS score of less than 1% signals a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted web page delivered over the internet, requiring only that the victim has WebGL support enabled in Chrome. No special local conditions are required beyond the presence of the affected browser build.

Generated by OpenCVE AI on August 3, 2026 at 12:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on Android to version 151.0.7922.72 or later.
  • Disable or restrict WebGL in Chrome settings or via command‑line flags to prevent the flaw from being exercised.
  • Deploy monitoring of WebGL traffic to detect anomalous rendering operations that may indicate exploitation attempts.

Generated by OpenCVE AI on August 3, 2026 at 12:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Thu, 30 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Thu, 30 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Uninitialized Use in WebGL
Weaknesses CWE-908
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}

threat_severity

Moderate

Thu, 30 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-457
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T13:32:54.930Z

Reserved: 2026-07-27T23:34:50.581Z

Link: CVE-2026-17808

cve-icon Vulnrichment

Updated: 2026-07-30T13:20:37.828Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:44.273

Modified: 2026-08-03T17:52:57.810

Link: CVE-2026-17808

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:27Z

Links: CVE-2026-17808 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:15:03Z

Weaknesses
  • CWE-457

    Use of Uninitialized Variable

  • CWE-908

    Use of Uninitialized Resource