CVE-2026-102313: Uninitialized Memory Read via ANGLE in Google Chrome on Windows · ZeroHour

CVE-2026-102313

mass

Uninitialized Memory Read via ANGLE in Google Chrome on Windows

CVSS 3.1

4.7 medium

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

Google Chrome on Windows prior to version 154.0.8037.92 contains a use of uninitialized memory (CWE-908) in ANGLE, the graphics translation layer Chrome uses to run WebGL on top of DirectX. A remote attacker triggers the flaw by convincing a victim to open a crafted HTML page, which causes ANGLE to consume uninitialized resources and expose process memory. Successful exploitation allows the attacker to read memory outside the browser sandbox, an information-disclosure sandbox escape that could leak sensitive data, though the CVSS base score of 4.7 reflects that user interaction is required and only confidentiality is impacted while Chromium rates the overall severity High. Only Chrome on Windows is named as affected; other platforms are not covered by this advisory. Google shipped the fix in Chrome 154.0.8037.92, and there is no known public proof of concept, no confirmed in-the-wild exploitation, and the CVE is not on CISA's KEV list.

What to do: Update Chrome on Windows to 154.0.8037.92 or later immediately (Chrome menu > Help > About Google Chrome forces the update and restart). Enterprise admins should verify fleet-wide browser versions via policy or device management and expedite rollout to stragglers, since no configuration change or workaround mitigates the underlying ANGLE flaw. Users of other Chromium-based browsers on Windows that bundle their own ANGLE should also apply those vendors' latest updates once released, but this CVE's fixed version applies specifically to Google Chrome.

Affected

Google Chrome (ANGLE graphics component)

Windows builds prior to 154.0.8037.92

Estimated exposure

masshundreds of millions of Windows Chrome users (order of magnitude 10^8–10^9 at disclosure) — Chrome holds roughly 60–70% of the desktop browser market and Windows is the dominant desktop OS, so the pre-patch population of vulnerable Windows installs is plausibly in the hundreds of millions, shrinking quickly as Chrome's…

Description

Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-908
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102313

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug