EUVD-2026-40609
GHSA-4w24-9gxj-7vcf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Delivered via crafted web page over network (AV:N/AC:L/PR:N), requires user to visit the page (UI:R), impacts only confidentiality with no integrity or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Uninitialized GPU memory use in Google Chrome on Android prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from process memory by luring a user to a crafted HTML page. The flaw (CWE-457) is confined to the Android GPU code path and requires only user interaction to trigger, with CVSS confirming unauthenticated network delivery and High confidentiality impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in stable channel version 150.0.7871.47.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) arises when a memory region in the GPU process is accessed before it has been properly zeroed or set. In Chrome's multi-process sandbox architecture, the GPU process handles hardware-accelerated rendering separately from the renderer process; on Android, when parsing or rendering attacker-controlled HTML content, certain GPU memory regions may be read while still containing residual data from prior allocations. This residual data - potentially credentials, tokens, or other in-memory artifacts - could then be exposed to the renderer or to script running in the attacker's page context. The EUVD entry EUVD-2026-40609 narrows the affected range to Chrome versions below 150.0.7871.47 specifically on Android; desktop Chrome platforms are not listed as affected by this particular GPU code path.
RemediationAI
Vendor-released patch: 150.0.7871.47. Users should update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store; Chrome typically auto-updates, but users should confirm the installed version under Settings > About Chrome. The advisory is available at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No documented workaround is confirmed in the available data; disabling hardware acceleration via chrome://flags/#disable-accelerated-2d-canvas could theoretically reduce GPU code surface but would degrade rendering performance and is not an officially documented mitigation - this trade-off is generally not warranted given the straightforward availability of the patch.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today