EUVD-2026-33215
GHSA-9gf2-vxp3-r9rg
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (Chrome) · only source for this CVE.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data disclosure in Google Chrome on Android (prior to 148.0.7778.216) stems from uninitialized GPU memory that a renderer-compromised attacker can read via a crafted HTML page. This is a second-stage, chained vulnerability - exploitation requires that the renderer process has already been compromised through a separate, unspecified vector. CVSS rates this Low (3.1) consistent with the constrained impact (C:L only) and high attack complexity; EPSS of 0.03% (11th percentile) confirms no public exploit identified at time of analysis.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) in Chrome's GPU process on Android. The GPU component processes rendering commands from the renderer process; when GPU memory buffers are not properly initialized, they may retain residual data from prior operations belonging to different origins. Because the GPU process handles content from multiple origins in a shared memory space, uninitialized reads can expose cross-origin data to a compromised renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to Chrome on Android, versions prior to 148.0.7778.216. CWE-457 class vulnerabilities in GPU drivers are particularly sensitive because GPU memory is not subject to the same OS-level memory isolation guarantees as CPU memory.
RemediationAI
Vendor-released patch: Chrome 148.0.7778.216. Users and administrators should update Google Chrome on Android to version 148.0.7778.216 or later via the Google Play Store or Chrome's built-in update mechanism. The fix is documented in the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and technical details are tracked in Chromium issue https://issues.chromium.org/issues/500138014. Because exploitation requires a prior renderer compromise, environments that already enforce restricted browsing (e.g., managed Android profiles blocking arbitrary web browsing) reduce - but do not eliminate - risk. No workaround that prevents GPU uninitialized memory reads without patching has been identified; the primary compensating control is preventing renderer compromise via timely patching of all Chrome components.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today