CVE-2026-95332 describes a use of an uninitialized variable in the Tint module of Google Chrome on Android. The flaw allows a crafted HTML page to cause the browser to read data from memory outside its sandbox. The impact is the disclosure of sensitive information that may exist in adjacent memory, potentially revealing secrets or compromising user data. This weakness is categorized as CWE-457, indicating a logical error that can lead to unintended information disclosure. The CVSS score is 4.7, indicating medium severity.

The vulnerability affects Chrome for Android versions prior to 154.0.8037.57. Users running any Android Chrome build older than this release are susceptible. The affected component is identified as the Tint rendering engine within the browser. All devices that install Chrome from the Google Play Store or directly from Google’s distribution channels and are running the affected versions would be impacted.

The CVSS score is 4.7, and the Chromium security team rated the severity as Medium. Because the attack requires a crafted HTML page delivered to the user, the attack vector is likely client‑side. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation. Nonetheless, local users who visit malicious or compromised web pages that target the browser’s rendering engine could potentially extract memory data. The absence of an active exploit hurts immediate risk, but the fundamental flaw permits an attacker with this capability to read arbitrary memory.