Uninitialized resource in the Dawn rendering engine of Google Chrome on Android allows a malicious web page to read memory beyond the sandbox. This results in an information disclosure of data that may include cookies, sensitive page content, or potentially exploitable secrets. The weakness is identified as CWE-908, which concerns use of uninitialized local variables. The chromium severity rating for this issue is Medium, indicating that while it does not provide direct code execution, it can expose confidential data to attackers.

Google Chrome for Android versions earlier than 155.0.8059.39 are affected. The vulnerability resides in the Dawn component of the browser, so any user running a pre‑155.0.8059.39 build on an Android device that can load web content is potentially vulnerable. Upgrading to 155.0.8059.39 fixes the problem.

The CVSS base score is 4.7, indicating a medium severity threat. The EPSS score is < 1%, so the contemporary probability of exploitation is very low. The vulnerability is not listed in CISA's KEV catalog, indicating no known widespread exploitation or reported incidents. The attack requires a remote attacker to serve a specially crafted HTML page that targets the uninitialized resource in Dawn; the attacker must persuade the victim to open or load that page in Chrome on Android. Once triggered, the memory read can bypass the sandbox barrier and access restricted data.