EUVD-2026-93677
GHSA-4qvh-w9q9-gmgf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage drives GPU operation with uninitialized resource
-
ExecutionRead memory outside sandbox
-
ImpactExfiltrate leaked data to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization
|
| Exploitation Conditions | Exploitation requires a victim running Google Chrome on Android prior to 155.0.8059.39 to actively load an attacker-crafted HTML page (UI:R); no authentication or special privileges are needed (PR:N) and default configurations are affected. The limiting factors are the mandatory user interaction (the victim must open the malicious page), the restriction to the Android platform per the description, and the partial nature of the leak - it discloses memory outside the sandbox (C:L) but grants no write/integrity or availability impact, so it is an information-disclosure primitive rather than code execution. |
| Impact | Signals are consistent and point to a genuine but low-to-moderate priority issue. The CVSS 3.1 base score is 4.7 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N: network-reachable, low complexity, no privileges, but requiring user interaction (loading a crafted page) and yielding only limited confidentiality impact (a memory read outside the sandbox) with no integrity or availability effect. EPSS is low at 0.24% (13th percentile), indicating a low modeled probability of exploitation in the near term, and the CVE is NOT on CISA KEV, with no POC referenced in the provided data - so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The signals do not conflict: a Chromium 'Medium' severity info-leak that needs user interaction and returns only partial memory contents is a real but non-urgent patch-management item rather than an emergency. One minor data note: the description contains a typo ('on on Android') and the CPE string (cpe:2.3:a:google:chrome) does not encode the Android platform, so the Android-specific scope comes only from the description text - verify platform applicability against the vendor advisory. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page and lures an Android Chrome user (version prior to 155.0.8059.39) to open it, e.g. via a link in a message or a malvertising frame. The page triggers the GPU's use of an uninitialized resource (CWE-908), causing Chrome to leak memory contents from outside the renderer sandbox back to attacker-controlled script, which can disclose sensitive data. No public exploit code is identified at time of analysis, and exploitation requires the victim to actively load the page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Memory disclosure in Google Chrome on Android before 155.0.8059.39 lets a remote attacker who persuades a victim to open a crafted HTML page read uninitialized GPU memory that lies outside the browser sandbox, exposing data the page should never be able to observe. The bug is rated CVSS 3.1 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) - unauthenticated remote triggering is possible but requires the victim to actively load the malicious page, only confidentiality is partially affected, and there is no integrity or availability impact, so this is an information-leak primitive rather than a code-execution path. Risk is currently low: EPSS is 0.24% (13th percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list it, but the disclosure crosses the sandbox boundary, which is why Google assigned Medium severity and the vector shows a scope change.
RemediationAI
The primary fix is to update Google Chrome on Android to version 155.0.8059.39 or later via the Google Play Store or the vendor's stable-channel release, which Google has published as the fixed build; the vendor reports a patch as available, and entitlement details are in the stable-channel advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html. Administrators managing Android fleets through an EMM/MDM should force-clear any Chrome update deferral or version pin so the 155.0.8059.39 build is actually installed, and should verify the reported Chrome version on endpoints rather than relying on the update being published. Practically speaking there is no feature-level workaround that removes the risk: the trigger is rendering attacker-controlled HTML, and disabling JavaScript or GPU acceleration would degrade browsing badly while only reducing - not eliminating - exposure to a GPU-process uninitialized-memory path, so these should be treated as stopgaps at best. While the update is pending, the most useful compensating controls are restricting browsing to trusted, allow-listed sites (mitigating the UI:R precondition at the cost of user flexibility), enabling Safe Browsing and platform-level exploit mitigations, and treating Android devices in high-value roles as prioritized for immediate upgrade; because the bug yields uninitialized memory contents, security teams should also consider a leaked-data review for any device known to have visited untrusted pages before patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an uninitialized-resource defect (CWE-908) in the Chrome GPU subsystem on Android: code consumes a memory buffer or resource before it is initialized, so stale or uninitialized contents from the GPU process are handed back to the renderer and become readable by the page. Because the leaked memory originates outside the renderer's own allocation, the disclosure crosses the browser's sandbox boundary - this is what the CVSS scope change (S:C) captures, and it distinguishes the issue from an ordinary same-origin information leak. The product is identified in the supplied CPE data as cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (NVD does not version-limit the Chrome entry), while the description and ENISA EUVD data pin the vulnerable window to Chrome on Android builds earlier than 155.0.8059.39. Chromium is written in C/C++ and moves graphics work through a separate, lower-privileged GPU process precisely to contain this class of bug; an uninitialized-read there undermines that containment, although the resulting primitive is read-only (C:L, I:N, A:N) and does not by itself give an attacker memory corruption or code execution. The vector requires network delivery and user interaction (PR:N, UI:R): the attacker hosts a page and relies on the victim visiting it, and the Android restriction limits the reachable population compared with a cross-platform Chrome bug.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Remote crafted page with no privileges but required user interaction (UI:R); reading memory beyond the sandbox is a scope change (S:C) with limited confidentiality only (C:L), no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB