An uninitialized GPU resource in Google Chrome on Android allowed a renderer process that had been compromised to read memory outside of its sandbox when loading a specially crafted HTML page. The memory read could potentially expose sensitive information, leading to information disclosure or further sandbox escape attacks. Chromium rated the vulnerability as Medium severity.

Google Chrome for Android versions earlier than 155.0.8059.39 are affected. Any Android device running the browser before this release, including OEM custom builds that embed Chrome, is vulnerable.

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of less than 1%, indicating a very low probability of exploitation. The CVSS score of 4.7 indicates a medium severity impact. Exploitation requires a remote attacker who has compromised the renderer process to deliver a crafted HTML page; when the renderer loads the page, the attacker can read memory outside its sandbox and potentially leak or manipulate data.