EUVD-2026-66041
GHSA-q287-g725-23jg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
No privilege needed to serve a crafted page; UI:R captures required page visit; C:H reflects sandbox-contained memory read; I:N and A:N as no modification or disruption occurs.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be running Google Chrome specifically on Android (not desktop Chrome) at a version prior to 152.0.7977.65. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 6.5 Medium with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects network delivery, no authentication, and required user interaction with a high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page engineered to trigger the GPU uninitialized resource flaw in Chrome for Android. A victim on an Android device running Chrome prior to 152.0.7977.65 visits the page - via phishing link, malvertising, or a compromised site - causing Chrome's GPU process to expose uninitialized memory to the attacker's JavaScript context. … |
| Remediation | Update Google Chrome on Android to version 152.0.7977.65 or later, as documented in the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today