An uninitialized GPU resource in Google Chrome on Android allows a remote attacker to read memory outside the sandbox through a crafted HTML page. The vulnerability, categorized as CWE‑908, permits disclosure of sensitive data stored in process memory, potentially exposing credentials or other private information. The impact is a memory‑content leak that bypasses the browser sandbox, leading to confidentiality compromise for the affected user.

The flaw exists in Google Chrome on Android versions prior to 155.0.8059.39. Newer releases of Chrome on Android and Chrome on other platforms are not affected.

The Chrome security team rates this issue as low severity with a CVSS score of 4.7, and it is not listed in the CISA KEV catalog. The EPSS score of <1% indicates a very low likelihood of exploitation, but the exact probability remains low. The attack vector requires the victim to load a malicious web page in Chrome on a vulnerable Android device, so the risk remains limited but a patch is recommended.