An uninitialized resource in Chrome’s GPU implementation on Android allows an attacker to craft a web page that causes the browser to read memory addresses outside the sandbox, enabling disclosure of sensitive data. The flaw is a medium‑severity vulnerability in Chromium's handling of GPU resources, classified as CWE‑908. The primary impact is that a remote attacker can read confidential information without needing local access.

Google Chrome on Android devices running versions earlier than 155.0.8059.39 are vulnerable. The issue affects the stable channel of Chrome on Android where the GPU subsystem has not yet applied the patch. All affected users who visit a maliciously crafted web page can trigger the exploit.

The CVSS score for this vulnerability is 4.7. The EPSS score is below 1%, indicating a very low but nonzero probability of exploitation. No current exploit code has been reported, and the vulnerability is not in CISA’s KEV catalog, suggesting that exploitation is not yet widespread but remains a realistic threat to affected users. Because the exploitation requires only a crafted HTML page viewed in the browser, a remote attacker with no prior foothold can potentially leverage the flaw.