Google Chrome EUVD-2026-93700

Exploitation requires the attacker to have ALREADY compromised the Chrome renderer process on Android (per the description's explicit precondition), after which a crafted HTML page triggers an uninitialized GPU resource to read memory outside the sandbox. This is specific to Google Chrome on Android prior to version 155.0.8059.39. Limiting factors: it is not a standalone entry point - a separate renderer-compromise vulnerability is a hard prerequisite; the victim must load attacker-controlled content (UI:R); impact is confined to information disclosure (no code execution, integrity, or availability loss); and versions at or above 155.0.8059.39 are patched.

This is a moderate, chain-dependent vulnerability rather than a standalone priority. The CVSS 3.1 base score of 4.7 (Medium) reflects limited confidentiality-only impact (C:L/I:N/A:N) with a scope change (S:C) representing the sandbox boundary crossing. Critically, the CVSS vector lists PR:N (no privileges) and AV:N (network), but the description explicitly states the attacker must have 'already compromised the renderer process' - a significant precondition the base vector does not capture, so the AV:N/PR:N signals overstate standalone exploitability. In practice this is a sandbox-escape primitive useful only as the second stage of a multi-bug exploit chain. Corroborating signals align with low real-world urgency: EPSS is 0.24% (13th percentile), there is no CISA KEV listing, and no public exploit code is identified. Google rated it Medium severity, consistent with an information-leak sandbox weakness rather than full RCE. Verdict: a real but low-priority defense-in-depth bug; patch in normal cadence. Note the conflict explicitly - CVSS implies unauthenticated network exploitation, but the description implies a prerequisite renderer compromise; defenders should treat the stated PR:N as optimistic.

An attacker who has already exploited a separate renderer-process vulnerability (e.g., via a malicious web page) uses this uninitialized GPU resource flaw to read memory contents that lie outside the renderer sandbox, harvesting sensitive data such as pointers or other process memory to aid sandbox escape. No public exploit code or active exploitation is identified at time of analysis; realistic use is as one link in a chained browser exploit. Delivery is a crafted HTML page that requires the victim to load it (UI:R).