Google Chrome EUVD-2026-66042

Exploitation requires the victim to be running Google Chrome on Android at a version prior to 152.0.7977.65 and to actively visit a crafted HTML page, satisfying the CVSS UI:R requirement. The vulnerability is specific to the GPU subsystem on Android; Chrome on Windows, macOS, iOS, and Linux is not confirmed affected by this particular initialization flaw. No authentication is required from the attacker (PR:N per CVSS), but the attacker must successfully deliver the crafted page to the victim, typically via phishing or malvertising. Exploitation is bounded to reading a limited region of uninitialized memory (C:L); it does not enable full sandbox escape, privilege escalation, or code execution on its own. Chrome's automatic background update mechanism on Android limits the window of exposure for most consumer devices, though enterprise-managed or update-deferred deployments may remain vulnerable longer.

Overall real-world risk is moderate-to-low. The CVSS base score of 4.3 with C:L/I:N/A:N accurately reflects a constrained information disclosure with no integrity or availability impact and no scope change (S:U), meaning this vulnerability alone cannot achieve full sandbox escape or code execution. The EPSS score of 0.31% at the 24th percentile is consistent with the Chromium team's own 'Low' severity rating and the absence of any CISA KEV listing; no public exploit code has been identified. The required user interaction (UI:R) introduces a social engineering prerequisite - the attacker must persuade a victim to visit a crafted page - which materially reduces opportunistic exploitation likelihood. The primary risk amplifier is scale: Chrome on Android is deployed across hundreds of millions of devices, meaning even a low-probability vulnerability carries nontrivial aggregate exposure. The EPSS score is low despite broad product prevalence, suggesting exploitation has not yet been commoditized or automated.

An attacker hosts a crafted HTML page containing WebGL or GPU-accelerated rendering operations designed to trigger uninitialized GPU memory reads in Chrome on Android. A targeted Android user visits the page through a phishing link, malvertising redirect, or compromised website, causing Chrome's GPU subsystem to process the content and expose uninitialized memory contents. The leaked memory could reveal heap layout, partial application data, or memory addresses that assist a chained follow-on exploit, though no exploit code has been publicly identified.