PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-78965 Google CVE debrief

The CVE-2026-78965 vulnerability, caused by an uninitialized resource in ANGLE within Google Chrome prior to version 152.0.7977.65, allows a remote attacker to obtain cross-origin data via a crafted HTML page. This issue has a CVSS score of 4.3, indicating a Medium severity level, and a High severity rating from Chromium. The vulnerability affects Google Chrome users, particularly those with high security requirements or exposed to potential cross-origin data theft. Users should be aware of this vulnerability and take steps to update their browsers. The CVE record was published on 2026-08-25T21:17:52.620Z and has not been modified since then.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-08-31
Advisory published
2026-08-25
Advisory updated
2026-08-31

Who should care

Google Chrome users, particularly those with high security requirements or exposed to potential cross-origin data theft, should be aware of this vulnerability and take steps to update their browsers. This includes administrators managing Chrome deployments, security teams monitoring for potential exploitation attempts, and users with sensitive data or high security needs.

Technical summary

The CVE-2026-78965 vulnerability is caused by an uninitialized resource in ANGLE within Google Chrome prior to version 152.0.7977.65. This issue allows a remote attacker to obtain cross-origin data via a crafted HTML page. The CVSS score for this vulnerability is 4.3, indicating a Medium severity level. The Chromium security severity is rated as High. The vulnerability affects Google Chrome users, particularly those with high security requirements or exposed to potential cross-origin data theft.

Defensive priority

Google Chrome users should prioritize updating to version 152.0.7977.65 or later to address the uninitialized resource vulnerability in ANGLE.

Recommended defensive actions

  • Update Google Chrome to version 152.0.7977.65 or later
  • Review and apply vendor-provided patches
  • Monitor for potential exploitation attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-78965 record indicates an uninitialized resource in ANGLE within Google Chrome prior to version 152.0.7977.65. This issue, with a CVSS score of 4.3, could allow a remote attacker to obtain cross-origin data via a crafted HTML page. The Chromium security severity is rated as High.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-78965 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-78965

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-78965 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-78965

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.