EUVD-2026-50875
GHSA-w6mp-47pm-392w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker domain
-
DeliveryDeliver malicious URL to Android Chrome victim
-
ExploitVictim loads page triggering GPU rendering
-
ExecutionUninitialized GPU memory read occurs
-
ImpactResidual cross-origin data exposed to attacker
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Exploitation requires the victim to actively navigate to an attacker-controlled HTML page using Google Chrome on Android - user interaction (UI:R) is mandatory and absent this, no exploit path exists. The vulnerability is platform-specific: only Chrome on Android is confirmed affected; desktop Chrome is not implicated. No authentication or special account privileges are required on the attacker's side. The limiting factors are: (1) required victim-side user interaction by visiting a malicious URL, (2) Android-only scope reducing the target population to mobile users, and (3) limited impact confined to partial cross-origin data disclosure with no write or denial-of-service capability. |
| Impact | The NVD CVSS 3.1 base score of 4.3 (Medium) reflects a network-accessible flaw with no required privileges but mandatory user interaction (UI:R) and only partial confidentiality impact (C:L), which aligns with Chromium's own Low severity designation. EPSS at 0.19% (9th percentile) indicates very low community-assessed likelihood of exploitation in the near term. There is no CISA KEV listing and no known public proof-of-concept. These signals collectively point to a low operational priority: the attack requires an attacker-controlled web page and a victim who actively visits it on an Android Chrome instance, the data leakage is bounded, and the fix is already available. The primary real-world concern would be targeted campaigns against high-value Android Chrome users rather than opportunistic mass exploitation. |
| Exploit ScenarioDerived | An attacker sets up a crafted HTML page engineered to trigger uninitialized GPU memory reads and hosts it on an attacker-controlled domain. A victim using Google Chrome on Android visits the page, either through a phishing link or a malicious advertisement, and Chrome's GPU subsystem reads uninitialized memory that may contain residual cross-origin data. The attacker receives fragments of data from other origins the victim has recently rendered, such as partial page content or resource data, without the victim's awareness. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The Chromium issue tracker reference https://issues.chromium.org/issues/517000034 contains additional technical detail. For users who cannot immediately update, a compensating control is to avoid visiting untrusted or unfamiliar websites on Android Chrome until the update is applied, as exploitation requires victim-initiated navigation to an attacker-controlled page. There is no known configuration toggle to disable the affected GPU code path without broader GPU acceleration impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-457 (Use of Uninitialized Variable) describes the root cause: the GPU processing pipeline in Chrome's Android renderer reads from memory that has not been properly initialized, exposing residual data. Because GPU memory can retain content from previous rendering contexts, including those belonging to different web origins, this class of bug can violate the Same-Origin Policy and leak fragments of cross-origin page content or resources. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to versions below 151.0.7922.72 on Android. The EUVD entry EUVD-2026-50875 confirms the affected range as any Chrome version below 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via web page requires no attacker privileges; active victim navigation mandates UI:R; impact is limited to partial confidentiality disclosure with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB