Google Chrome CVE-2026-106275

Exploitation requires the victim to load attacker-controlled HTML in Google Chrome for Android on a version prior to 155.0.8059.39; the uninitialized resource lives in the browser's GPU process, so the crafted page must exercise the affected GPU/rendering code path. Limiting factors: user interaction is mandatory (UI:R - the user must navigate to or open the malicious page), and the outcome is confined to reading (not writing) a limited amount of memory, giving only a partial information leak with no code execution, data tampering, or denial of service on its own. Patched builds (155.0.8059.39 and later) are not affected.

This is a low-priority, low-severity issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, base 4.7 MEDIUM) shows a remote, low-complexity, unauthenticated vector that nonetheless requires user interaction (the victim must load a crafted HTML page) and yields only a low-confidentiality impact with no integrity or availability effect - consistent with Chromium's own 'Low' severity rating. EPSS corroborates minimal real-world urgency at 0.19% (8th percentile), and the flaw is NOT listed in CISA KEV and has no identified public exploit. CWE-908 (use of uninitialized resource) in the GPU process leaking memory across the sandbox boundary is a genuine but limited information-disclosure primitive - typically useful as an ASLR/info-leak aid in a chained exploit rather than a standalone threat. No SSVC decision data was provided in the input, so automatable/technical-impact determinations cannot be made. One data conflict to note: the description explicitly scopes this to 'Google Chrome on Android,' yet the primary vendor reference is the Chrome Stable Channel update for DESKTOP - verify the correct advisory and affected platform with the Chrome release notes, as the linked blog post may not match the Android scope.

An attacker hosts or compromises a web page containing malicious content that triggers the uninitialized-memory condition in Chrome's GPU process when the Android victim navigates to it. The leaked out-of-sandbox memory bytes could expose pointers or secrets useful for defeating ASLR in a larger exploit chain. No public exploit code has been identified, and successful exploitation depends on the user actually visiting the crafted page.