The vulnerability is an uninitialized variable in the GPU code path of Google Chrome for Android. A crafted HTML page can trigger the bug, causing the browser to read memory that belongs to another origin. This results in a confidentiality breach, potentially exposing sensitive information from other websites that the user has visited. The underlying weakness is a 457 use‑of‑uninitialized‑variable flaw.

All users of Google Chrome for Android with a version earlier than 149.0.7827.155 are potentially affected. It is inferred from the advisory that the issue is unique to the Android build and does not impact Chrome on desktop or other Google products.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation. The likely attack vector requires an attacker to host a malicious HTML page and have the victim open it in Chrome for Android. No public exploits have been reported. It is inferred that the patch is included in the stable channel update released in June 2026. The risk remains moderate due to the moderate score and low exploitation probability.