Google Chrome Android EUVD-2026-66041

Exploitation requires the target to be running Google Chrome specifically on Android (not desktop Chrome) at a version prior to 152.0.7977.65. The CVSS vector (UI:R) confirms user interaction is mandatory - the victim must navigate to or otherwise load the attacker's crafted HTML page; passive drive-by without page load is insufficient. No authentication or special application configuration is required from the attacker's perspective (PR:N), but the attack is inherently client-side. The primary limiting factors are: (1) platform specificity - only the Android version of Chrome is affected; (2) sandbox containment - any memory read is restricted to Chrome's GPU sandbox, not Android OS or other app memory, substantially reducing the exploitable data surface; and (3) required user interaction limits opportunistic mass exploitation.

The NVD CVSS score of 6.5 Medium with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects network delivery, no authentication, and required user interaction with a high confidentiality impact. Three signals substantially temper operational priority: vendor-assigned Chromium severity is 'Low', indicating the team assessed sandbox containment as a meaningful mitigator; EPSS of 0.31% places this in the 24th percentile, well below thresholds commonly used for emergency patching; and there is no CISA KEV listing and no known POC code. The S:U (scope unchanged) metric confirms the read is sandbox-contained - an attacker cannot pivot to the Android OS or other apps. While Chrome's ubiquitous Android deployment means the theoretical exposure population is enormous, real-world exploitation value is limited by the sandbox boundary. This should be addressed through normal patch cycles rather than emergency out-of-band response.

An attacker hosts a crafted HTML page engineered to trigger the GPU uninitialized resource flaw in Chrome for Android. A victim on an Android device running Chrome prior to 152.0.7977.65 visits the page - via phishing link, malvertising, or a compromised site - causing Chrome's GPU process to expose uninitialized memory to the attacker's JavaScript context. The attacker reads sandbox-contained memory, potentially recovering in-browser data such as cached credentials, session tokens, or rendered page content from other tabs within the same sandbox boundary.