The vulnerability stems from an uninitialized GPU resource in Chrome that allows a renderer process compromised by a remote attacker to read memory beyond the sandbox. This can expose private data or local application state, and Chromium classifies it as a high severity issue under CWE-908.

Chrome on Android prior to build 154.0.8037.92 is affected. Users running the Android Chrome app older than that build are at risk until they receive the upgrade bundle delivered through the normal update channel.

The base CVSS score is 3.4, indicating a low overall impact, but the Chromium severity and the fact that any data exposed may be highly sensitive increase the real‐world risk. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation generally requires that the renderer process has already been compromised, so a crafted HTML page must be delivered in the context of another vulnerability. Consequently, the flaw is an out‑of‑bounds read in a sandboxed process, posing a potential data disclosure risk that warrants prompt remediation.