EUVD-2026-28143Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory renderer-compromise prerequisite; C:H for process memory leak; I:N and A:N as no write or denial-of-service impact is described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Uninitialized GPU memory disclosure in Google Chrome for Android (prior to 148.0.7778.96) enables a post-exploitation information leak from process memory. Exploitation requires that the attacker has already compromised the renderer process - making this a chained vulnerability, not a standalone entry point. No active exploitation is confirmed (not in CISA KEV, SSVC exploitation status: none), and EPSS sits at 0.03% (8th percentile), consistent with a low-real-world-priority issue despite the C:H confidentiality rating.
Technical ContextAI
The vulnerability is rooted in CWE-457 (Use of Uninitialized Variable) within Chrome's GPU process on Android. Chrome's multi-process architecture isolates the renderer, GPU, and browser processes; however, when an attacker already controls the renderer, they can craft HTML that exercises the uninitialized GPU memory path, causing the GPU process to read and potentially return uninitialized memory to the attacker-controlled renderer. Affected product per CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Android, all versions prior to 148.0.7778.96. This class of flaw is commonly exploited as the second stage in a two-bug chain (sandbox escape + info leak) to bypass ASLR or recover pointer values.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.96. Update Google Chrome on Android to version 148.0.7778.96 or later via the Google Play Store or Chrome's built-in update mechanism. Details are available at the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html and tracked in the Chromium issue tracker at https://issues.chromium.org/issues/498382925. Because exploitation requires a prior renderer compromise, organizations that cannot immediately patch should prioritize blocking attacker-controlled web content delivery (e.g., restrict browsing to trusted sites via enterprise policy) as a compensating control, though this limits browser functionality. No workaround eliminates the uninitialized memory flaw itself.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today