EUVD-2026-37519Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring active user visit (UI:R); limited cross-origin data leakage only (C:L) with no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome on Android prior to 149.0.7827.155 is triggered by an uninitialized GPU memory condition exploitable through a crafted HTML page. An unauthenticated remote attacker (per CVSS PR:N) can cause a victim's Android Chrome browser to expose limited data from other browser origins when the user visits a malicious page. No public exploit has been identified and EPSS at 0.30% (21st percentile) with SSVC exploitation:none signals low real-world exploitation probability at time of analysis.
Technical ContextAI
The flaw resides in the GPU process component of Google Chrome on Android (CPE: cpe:2.3:a:google:chrome). CWE-457 (Use of Uninitialized Variable) is the root cause class: GPU-bound memory allocations are accessed before being zeroed or populated, meaning residual content from prior GPU operations - potentially belonging to a different web origin - can be read by a page exploiting the flaw. On Android, Chrome routes rendering through hardware GPU acceleration via a sandboxed GPU process; uninitialized state in this component can straddle security boundaries between origins since the GPU is a shared resource. This makes it a cross-origin information disclosure rather than a full memory corruption issue, consistent with the CWE-457 classification and the C:L/I:N/A:N CVSS impact profile.
RemediationAI
Update Google Chrome on Android to version 149.0.7827.155 or later - this is the vendor-released patch per the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html. Android users should verify that automatic Chrome updates are enabled via the Google Play Store. As a compensating control prior to patching, restricting navigation to untrusted or unknown websites through enterprise Mobile Device Management (MDM) policy or DNS filtering reduces the attack surface, though it does not remediate the underlying flaw. Chrome's existing Site Isolation feature (enabled by default) provides partial cross-origin defense but does not mitigate the uninitialized GPU memory path specifically. No known workaround disables the vulnerable GPU code path without disabling hardware acceleration, which would significantly degrade browser performance.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today