Uninitialized GPU resources in Chrome enable a compromised renderer process to read memory outside the sandbox when a malicious HTML page is served to the user. This flaw does not give direct code execution but allows an attacker to leak sensitive data from the browser’s memory space, potentially exposing credentials or other secrets. The weakness arises from improper initialization of GPU memory objects, classified as CWE-908.

Google Chrome on Android versions prior to 157.0.8103.38 is vulnerable. Any device running these versions and allowing rendering of crafted web content is impacted.

The flaw requires an attacker to already have compromised the renderer process, typically via a separate vulnerability or deceptive content. There is no publicly reported widespread exploitation, and the EPSS score is not available. Because it is not listed in the CISA KEV catalog and lacks a high CVSS score, the risk is considered moderate, but the potential to leak arbitrary memory makes patching a high priority.