Chrome Android uses GPU for rendering web content. A flaw in the GPU driver caused uninitialized memory to be read during certain rendering operations, allowing a malicious web page to extract data from process memory. The attacker can obtain sensitive information such as cookies, credentials, or other secrets stored in Chrome’s memory, creating an information‑disclosure vulnerability.

Google Chrome running on Android devices affected by versions prior to 149.0.7827.197. The issue applies to the stable channel release referenced in the 2026‑06 update notes. Devices using earlier Chrome builds are vulnerable.

An attacker can exploit this remote vulnerability by hosting a crafted HTML page and convincing a user to visit it while Chrome is running. Because the flaw exploits GPU processing, it requires no local execution or elevated privileges; the only prerequisite is that the victim browses a malicious page. The CVE’s CVSS score of 5.3 indicates moderate severity, and although EPSS data is not currently available, the lack of a KEV listing indicates no known public exploits yet. Nevertheless, the ease of delivery via web content and the potential for significant data leakage warrant immediate attention.