What is the CVSS score of CVE-2026-10008?

CVE-2026-10008 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10008?

Yes, a patch is available for CVE-2026-10008. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10008

EUVD-2026-33150 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-05-28 Chrome

GHSA-2p92-92xp-pw8j

Google Information Disclosure Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 20:36 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized GPU memory use in Google Chrome on Android prior to 148.0.7778.216 enables remote attackers to read potentially sensitive data from the browser's GPU process memory. Exploitation requires user interaction - a victim must visit a crafted HTML page - and is confined to the Android platform, narrowing real-world exposure relative to the CVSS C:H impact rating. No public exploit code exists and this vulnerability is absent from CISA KEV; EPSS at 0.03% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.

Technical ContextAI

The vulnerability resides in Chrome's GPU process on Android (CPE: cpe:2.3:a:google:chrome). CWE-457 (Use of Uninitialized Variable) identifies the root cause as a memory region associated with GPU operations being read before proper initialization, allowing residual process memory contents to leak. Chromium's architecture separates browser, renderer, and GPU processes for sandboxing; GPU-accelerated rendering involves inter-process communication and shared memory buffers. Crafted HTML - likely leveraging WebGL or other GPU-accelerated web APIs - can influence how these buffers are allocated and read, causing uninitialized data to be exposed to web content. The vulnerability is explicitly scoped to Android, suggesting a platform-specific GPU driver interaction or Android-specific GPU process code path is involved.

RemediationAI

Update Google Chrome on Android to version 148.0.7778.216 or later, which is the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Android users should verify the update via the Google Play Store or within Chrome's settings menu under 'About Chrome'. No official workaround has been published by Google. As a temporary compensating control with significant usability trade-offs, disabling GPU acceleration via chrome://flags (#disable-gpu) would reduce the GPU attack surface but will substantially degrade rendering performance and break GPU-dependent web features - this is not recommended as a sustained mitigation. Restricting user browsing to known-trusted origins on unpatched devices reduces exposure but does not eliminate risk, as attacker-controlled content could be embedded in otherwise trusted sites via ads or iframes.