Description
Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-07-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Google Chrome versions before 151.0.7922.72, an improper WebGL implementation can be leveraged by a remote attacker to read the browser’s process memory through a crafted HTML page, potentially exposing sensitive data. The flaw aligns with CWE-200, which concerns unauthorized disclosure of information.

Affected Systems

Google Chrome users running any release older than 151.0.7922.72 are affected. The vulnerability is specific to the WebGL component of the browser and does not impact other browsers or Chrome extensions.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of < 1% shows the model currently estimates a low exploit probability, and the vulnerability is not listed in the CISA KEV catalog, so no confirmed active exploitation is known. Nevertheless, the attack vector is remote and requires only that a user load a malicious web page, so the risk remains realistic for general users if no mitigation is applied.

Generated by OpenCVE AI on August 3, 2026 at 11:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 151.0.7922.72 or newer. This patch removes the vulnerability in the WebGL implementation.
  • If an immediate update is unavailable, disable WebGL in Chrome flags or via group policy, which blocks the affected API paths.
  • Additionally, monitor and restrict the loading of arbitrary web content in sensitive environments, and keep an eye on Chrome security advisories for further developments.

Generated by OpenCVE AI on August 3, 2026 at 11:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Sat, 01 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title WebGL Process Memory Disclosure via Crafted HTML chromium-browser: chromium-browser: Inappropriate implementation in WebGL
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 31 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title WebGL Process Memory Disclosure via Crafted HTML

Thu, 30 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T15:19:19.551Z

Reserved: 2026-07-27T23:37:16.256Z

Link: CVE-2026-18001

cve-icon Vulnrichment

Updated: 2026-07-30T15:19:13.557Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:17:04.797

Modified: 2026-08-03T16:06:55.173

Link: CVE-2026-18001

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-30T00:26:03Z

Links: CVE-2026-18001 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T11:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-825

    Expired Pointer Dereference