EUVD-2026-33150
GHSA-2p92-92xp-pw8j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized GPU memory use in Google Chrome on Android prior to 148.0.7778.216 enables remote attackers to read potentially sensitive data from the browser's GPU process memory. Exploitation requires user interaction - a victim must visit a crafted HTML page - and is confined to the Android platform, narrowing real-world exposure relative to the CVSS C:H impact rating. No public exploit code exists and this vulnerability is absent from CISA KEV; EPSS at 0.03% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Technical ContextAI
The vulnerability resides in Chrome's GPU process on Android (CPE: cpe:2.3:a:google:chrome). CWE-457 (Use of Uninitialized Variable) identifies the root cause as a memory region associated with GPU operations being read before proper initialization, allowing residual process memory contents to leak. Chromium's architecture separates browser, renderer, and GPU processes for sandboxing; GPU-accelerated rendering involves inter-process communication and shared memory buffers. Crafted HTML - likely leveraging WebGL or other GPU-accelerated web APIs - can influence how these buffers are allocated and read, causing uninitialized data to be exposed to web content. The vulnerability is explicitly scoped to Android, suggesting a platform-specific GPU driver interaction or Android-specific GPU process code path is involved.
RemediationAI
Update Google Chrome on Android to version 148.0.7778.216 or later, which is the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Android users should verify the update via the Google Play Store or within Chrome's settings menu under 'About Chrome'. No official workaround has been published by Google. As a temporary compensating control with significant usability trade-offs, disabling GPU acceleration via chrome://flags (#disable-gpu) would reduce the GPU attack surface but will substantially degrade rendering performance and break GPU-dependent web features - this is not recommended as a sustained mitigation. Restricting user browsing to known-trusted origins on unpatched devices reduces exposure but does not eliminate risk, as attacker-controlled content could be embedded in otherwise trusted sites via ads or iframes.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today