Uninitialized use of GPU memory in Chrome for Android versions before 148.0.7778.216 enables a remote attacker to read sensitive data from the browser’s process memory. The vulnerability occurs when the GPU driver accesses memory that has not been initialized, and the data is made available through a crafted HTML page executed in the browser context. Consequently, attackers can potentially exfiltrate confidential information such as credentials or personal data, resulting in a privacy breach.

Affected systems are Google Chrome browsers running on Android devices with versions older than 148.0.7778.216. No other platforms or operating systems are listed in the vendor’s advisory, and the flaw is specific to the GPU component of Chrome on Android.

The exploitability assessment shows that the EPSS score is not available and the vulnerability, with a CVSS score of 6.5, is not listed in the CISA KEV catalog, but the Chromium severity rating is high. Attackers can trigger the flaw by delivering a malicious HTML page to the victim’s device, enabling the unauthorized memory read. The risk remains significant for any user who accesses untrusted web content without the latest Chrome update.