Technical impact
Uninitialized GPU resources in Chrome Android versions older than 154.0.8037.92 enable a remote attacker to extract cross‑origin data via a specially crafted HTML page. The weakness arises from misusing GPU memory, and the CVE classifies it as a high‑severity information‑leakage flaw (CWE-908). This can result in the disclosure of sensitive user data without any user interaction beyond loading the malicious page.
Affected Systems
Only users running Google Chrome on Android with versions older than 154.0.8037.92 are affected. Based on the description, it is inferred that desktop editions are not impacted because no mention of them is present.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate technical complexity, while the absence of an EPSS score makes the exploitation probability uncertain at present. The vulnerability is not listed in the CISA KEV catalog, and no exploit has been reported. A crafted malicious web page can be used by an attacker once the target visits it, so the attack vector is remote and requires only that the victim open a malicious HTML document in Chrome Android.
Debian DLA
Debian DSA