Google Chrome CVE-2026-102307

Requires the victim to load attacker-controlled HTML in Chrome for Android prior to 154.0.8037.92 that exercises the Dawn WebGPU graphics backend (i.e. WebGPU must be reachable/enabled for the crafted content). Limiting factors: user interaction is required (UI:R - the victim must visit the page), and while no authentication is needed (PR:N), the payoff is a low-confidence memory read only, useful chiefly as an information-leak building block rather than standalone compromise. Scoped to the Android platform per the advisory.

Signals are consistent and point to a genuine but low-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N = 4.7) reflects a network-reachable flaw needing only that a victim load a crafted HTML page (UI:R), with a scope change (S:C) because memory is read OUTSIDE the renderer sandbox, but impact is limited to a low-confidence read (C:L) with no integrity or availability effect. Note the divergence between Chromium's internal 'High' severity rating and the NVD-style 4.7: Chromium rates memory-safety bugs by worst-case potential, while the scored vector captures the confirmed info-leak-only impact - treat 4.7 as the realistic figure. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - not active exploitation. A patch is available from the vendor. Bottom line: real but low-priority; an information-disclosure primitive (often useful only as one link in a larger exploit chain, e.g. ASLR defeat) rather than a directly weaponizable RCE.

An attacker hosts a malicious web page that drives Chrome's Dawn WebGPU backend to use an uninitialized graphics resource; when an Android user visits the page, the flaw leaks bytes of memory from outside the renderer sandbox back to attacker-controlled script. No public exploit code is identified, and the low confidentiality impact means the leaked data is partial rather than a full memory dump.