An uninitialized GPU resource in Google Chrome on Android allows a compromised renderer process to read memory outside the sandbox through a crafted HTML page. The vulnerability exploits a flaw in the way GPU memory is allocated and initialized, permitting the attacker to access data that should remain isolated to the renderer. The primary consequence is the potential for sensitive information disclosure, which could be leveraged if additional exploitation paths are available. The Chrome security team has rated the issue as medium severity, indicating the risk is significant but not immediate catastrophic.

All Android users running Google Chrome versions earlier than 155.0.8059.39 are affected. The vulnerability resides in the GPU code that interfaces with the renderer process; any device that installs the affected Chrome build on Android is within scope. Versions 155.0.8059.39 and later contain the remediation.

The CVSS score of 4.7 indicates medium severity. The EPSS score of <1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. However, the flaw still requires that the renderer process be compromised, which typically demands a successful drive‑by or phishing attack. The potential impact is information disclosure if an attacker can read memory outside the sandbox, but the limited public exploitation data mitigates immediate risk while acknowledging a possibility of targeted exploitation in the future.