Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2026-87642)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Googlegoogle/chromepkg:deb/google/chromeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users should update Google Chrome to version 153.0.8010.36 or later once a fix is officially released. Until then, cautious browsing and avoiding untrusted web content may reduce exposure.
Description
A vulnerability in Google Chrome's WebGL implementation prior to version 153.0.8010.36 allows a remote attacker to leak cross-origin data by exploiting an uninitialized resource. This issue could be triggered via a crafted HTML page. The Chromium project has assigned a medium severity level to this security flaw.
Impact
The vulnerability allows unauthorized disclosure of cross-origin data, which can lead to information leakage between different web origins. This compromises the confidentiality of data accessible through the browser's WebGL interface. The impact is limited to data leakage and does not indicate code execution or privilege escalation.
Weaknesses
- CWE-908Use of Uninitialized Resource (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses or accesses a resource that has not been initialized.