Google Chrome CVE-2026-106395

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build on Android prior to 155.0.8059.39, and the affected code path is Dawn, Chrome's WebGPU implementation, so content that exercises WebGPU/graphics processing is needed to reach the uninitialized resource. Key limiting factors: user interaction is mandatory (UI:R - the attacker cannot trigger this without the victim visiting attacker-influenced content), the impact is confined to a LOW-confidentiality out-of-sandbox memory read (no write/integrity or availability impact), and per the description the exposure is specific to the Android platform despite the generic CPE. No special authentication or privileged configuration is required (PR:N).

This is a genuinely low-to-moderate priority issue despite affecting a ubiquitous product. The signals are largely consistent and point AWAY from urgency: CVSS is only 4.7 (Medium), Chromium's own severity rating is Medium, EPSS is 0.19% at the 8th percentile (very low predicted exploitation probability), the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is referenced. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) shows a network-reachable, low-complexity, unauthenticated flaw, but one that REQUIRES user interaction (UI:R - the victim must visit a crafted page) and yields only LOW confidentiality impact with NO integrity or availability impact. The scope change (S:C) is meaningful here because the attacker reads memory OUTSIDE the renderer sandbox, which is why this rates above a trivial info leak, but a single Medium-severity uninitialized-memory read (CWE-908) is typically useful only as one primitive in a larger exploit chain, not as a standalone compromise. One caveat to verify: the description scopes this to 'Google Chrome on Android,' yet the CPE string is the generic cpe:2.3:a:google:chrome (no platform/Android qualifier), so the affected-platform breadth should be confirmed against the Chrome release notes rather than the CPE alone.

An attacker hosts or compromises a web page containing crafted HTML/graphics content that triggers the uninitialized resource in the Dawn (WebGPU) implementation. When a victim using a vulnerable Chrome build on Android navigates to the page, the flaw leaks a small amount of memory from outside the browser sandbox back to attacker-controlled script. No public exploit code was identified at time of analysis; realistically this would serve as an information-disclosure primitive (e.g., defeating ASLR) feeding a larger exploit chain rather than a direct compromise.