CVE-2026-17667

This is an uninitialized memory read in ANGLE's graphics translation layer that enables cross-origin data leakage in browsers. ANGLE sits between WebGL and native GPU APIs (Vulkan, Metal, D3D), and this vulnerability exposes data from one origin to another through the translation boundary — a direct violation of browser isolation guarantees. The affected code is in ANGLE's translation state management, where a struct field is read before being initialized on certain error-handling paths. The field is expected to be overwritten by translation logic before consumption in normal rendering flows, but error paths, context switching, or resource reallocation can trigger the read before initialization completes. This is the same structural class of vulnerability that has appeared approximately eight times in ANGLE and similar translation layers over the past six years — consistently in error-translation paths where test coverage is thinnest. What makes this particularly dangerous is ANGLE's horizontal blast radius: a single uninitialized field in translation logic propagates across Vulkan, Metal, and D3D backends simultaneously. The vulnerability sits at the chokepoint where browser-renderer isolation meets kernel-level GPU access, so when memory safety fails there, it fails at the security boundary rather than in peripheral code. Chromium rates this 'High' despite the 6.5 CVSS — the scoring framework doesn't account for the force-multiplier effect of translation layer position in the trust graph. Check your deployments: any Chromium-based browser (Chrome, Edge, Brave, Opera, downstream Chromium derivatives) with ANGLE enabled is exposed. You can verify by navigating to chrome://gpu and checking 'ANGLE' under 'Graphics Feature Status'. The fix requires a patch to the specific translation state struct — verify your browser version against the CVE publication and confirm the patch is applied. Beyond patching, flag this as a candidate for architectural review: uninitialized use keeps surfacing in the same structural positions (error-handling paths in translation layers) because these paths are under-tested and accumulate what amounts to dormant assumptions as code evolves. Treat deprecated translation paths as security-critical code rather than legacy that doesn't need touching.

Reviewed through automated stages and approved by a human before publication.