Description
Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote memory disclosure via GPU memory corruption
Action: Immediate Patch
AI Analysis

Impact

An uninitialized resource in the GPU component of Google Chrome on Android, present in versions prior to 156.0.8078.47, enables a remote attacker to read memory outside the browser sandbox through a crafted HTML page. This flaw can expose sensitive data that should remain isolated within the sandbox, thereby compromising confidentiality. The vulnerability is represented by CWE-908.

Affected Systems

The issue affects Chrome for Android versions prior to 156.0.8078.47. Users running older releases of the Chrome browser on Android devices are potentially vulnerable until they upgrade to the patched version.

Risk and Exploitability

The attack vector is inferred to be a remote web page served to the victim; the attacker must craft a malicious HTML document that exploits the GPU memory handling bug. The CVSS score is 6.5, and the EPSS score is < 1%, which indicates a low probability of exploitation. The vulnerability is not listed in CISA KEV and no public exploit is known, but the potential for memory disclosure warrants cautious handling.

Generated by OpenCVE AI on November 4, 2026 at 07:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome for Android to version 156.0.8078.47 or later, as released on the official Chrome Release blog
  • If updating immediately is not possible, temporarily disable GPU hardware acceleration in Chrome settings to mitigate the exploitation path
  • Restrict the handling of foreign webpages by applying strict content security policies and ensuring that only trusted sources are accessed

Generated by OpenCVE AI on November 4, 2026 at 07:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4853-1 chromium security update
Debian DSA Debian DSA DSA-6577-1 chromium security update
History

Wed, 04 Nov 2026 06:30:00 +0000

Type Values Removed Values Added
Title GPU Memory Corruption in Chrome Allows Remote Memory Disclosure

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119

Tue, 03 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Uninitialized resource in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-908

Thu, 22 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Title GPU Memory Corruption in Chrome Allows Remote Memory Disclosure

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Google chrome

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Memory corruption in GPU in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-119
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:20:58.837Z

Reserved: 2026-10-19T23:16:46.515Z

Link: CVE-2026-113304

cve-icon Vulnrichment

Updated: 2026-10-21T15:10:51.798Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:19:24.597

Modified: 2026-11-03T22:19:08.910

Link: CVE-2026-113304

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T07:15:09Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource