Google Chrome CVE-2026-102311

Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process on Android - this is the primary limiting precondition and the reason PR is effectively high in practice despite PR:N in the scored vector. Beyond that, the victim must load attacker-controlled crafted HTML (UI:R - user interaction/navigation required), and the attack has high complexity (AC:H) tied to reliably triggering the uninitialized GPU resource. It affects Google Chrome on Android before version 154.0.8037.92; patched builds are unaffected. Impact is confined to reading memory outside the sandbox (information disclosure only) - no code execution or state modification results directly from this flaw.

This is a genuine but LOW-priority issue despite the 'Chromium security severity: High' label. The NVD CVSS is only 3.4 (Low), and the vector explains why: exploitation requires an already-compromised renderer process (a significant precondition not scored in PR), high attack complexity (AC:H), user interaction (UI:R), and yields only a partial confidentiality leak with no integrity or availability impact (C:L/I:N/A:N). The scope change (S:C) reflects reading memory OUTSIDE the sandbox, which is what elevates Chromium's internal rating, but the real-world impact is limited to information disclosure from a memory region, not code execution or a full sandbox escape. There is no EPSS score provided, no CISA KEV listing, and no public POC identified - so exploitation status is 'no public exploit identified at time of analysis.' The Chromium-High vs NVD-Low gap is a signal contrast worth noting: Chromium rates memory-safety-outside-sandbox highly on principle, but as a standalone bug (requiring a pre-existing renderer compromise) its practical risk is modest. No conflicting AV data - network vector is consistent with a crafted HTML page delivered to the browser.

An attacker who has already compromised Chrome's renderer process on Android (via a separate bug) lures the victim to a page containing crafted HTML that triggers use of an uninitialized GPU resource, causing the browser to read and leak memory contents from outside the renderer sandbox. This is a chained secondary bug, not a standalone entry point; no public exploit code is known. The high complexity and dependence on a prior renderer compromise make opportunistic mass exploitation unlikely.