Google Chrome EUVD-2026-89381

Exploitation requires the victim to run Chrome on Android older than 154.0.8037.92 and to load an attacker-controlled or attacker-injected HTML page that drives GPU rendering (e.g., WebGL/canvas) to read back uninitialized GPU memory. No authentication is needed (PR:N) and the vector is remote (AV:N), but exploitation is gated by required user interaction (UI:R - the victim must open the page) and by the platform constraint (Android-specific Chrome GPU path). Impact is limited to disclosure of cross-origin data (C:L); there is no code execution, data modification, or denial of service, and SSVC marks the bug non-automatable, limiting scalable/opportunistic use.

This is a genuinely lower-priority Chrome flaw despite the 'High' Chromium severity label, which reflects the class of bug (GPU memory safety) rather than real-world impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N = 4.3) is network-reachable and unauthenticated but requires user interaction (visiting a crafted page) and yields only limited confidentiality impact (C:L) with no integrity or availability effect - an uninitialized-memory read that leaks cross-origin data, not code execution. All exploitation signals are quiet and mutually consistent: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit code identified. Unlike the memory-corruption RCE siblings in the same Chrome release, this bug's payoff is a cross-origin information leak of GPU-resident data, making it useful for reconnaissance/data theft rather than device takeover. Net: real but modest risk - patch on the normal Chrome update cadence rather than as an emergency. No signals conflict; the primary limiter is UI:R plus the low technical impact.

An attacker hosts or injects a malicious HTML page containing crafted GPU/canvas/WebGL content and lures an Android Chrome user to visit it. Uninitialized GPU memory is read back into the page's context, letting the attacker exfiltrate residual cross-origin pixel or buffer data that should have been isolated. No public exploit code exists and SSVC rates the bug non-automatable, so realistic exploitation would be targeted rather than mass-scale.