EUVD-2026-39044
GHSA-53ww-g6wp-vwp6
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Crafted HTML page delivered over network (AV:N), reliable GPU memory leak requires conditions outside attacker control (AC:H), no authentication needed (PR:N), user must visit page (UI:R), confidentiality-only impact with no integrity or availability effect.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Uninitialized GPU memory use in Google Chrome on Android before 149.0.7827.197 exposes process memory contents to remote attackers without requiring authentication. An attacker who induces a user to load a crafted HTML page can read potentially sensitive data from Chrome's GPU process memory, consistent with the High confidentiality impact assigned in the CVSS vector. No public exploit code exists at time of analysis, and CISA's SSVC framework classifies exploitation as none and not automatable with only partial technical impact - indicating this is a patch-cycle priority rather than an emergency response item.
Technical ContextAI
CWE-457 (Use of Uninitialized Variable) describes a condition where memory allocated for GPU operations is accessed before being properly written. In Chrome's Android rendering architecture, the GPU process handles hardware-accelerated compositing and rasterization; uninitialized buffers in this subsystem can retain residual data from prior allocations - potentially including fragments of previously rendered content or other sensitive in-process data - which a crafted HTML page can then trigger and potentially expose. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all Chrome versions prior to 149.0.7827.197, though the description and EUVD-2026-39044 scope this specifically to the Android platform. Desktop and iOS Chrome are not referenced as affected by this issue.
RemediationAI
The vendor-released patch is Google Chrome 149.0.7827.197 for Android; users should update immediately via Google Play or Chrome's built-in update mechanism, as documented in the stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. Enterprise teams managing Android device fleets via MDM should verify that Chrome update deferrals are not in effect and push the update proactively. If immediate patching is not operationally feasible, a compensating control is to enforce navigation restrictions to untrusted external websites on affected devices - this limits the attacker's ability to deliver the crafted HTML page, though it substantially reduces browser utility. No other workaround is known to fully neutralize the uninitialized GPU memory exposure short of applying the 149.0.7827.197 patch.
Same weakness CWE-457 – Use of Uninitialized Variable
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today