CVE-2026-95359

chromium-browser: chromium-browser: Uninitialized resource in GPU

View on CVE.org
Published Sep 29, 2026 CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Description
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

An uninitialized GPU resource in Google Chrome on Android permits a crafted HTML page to cause the renderer process to read memory outside its sandbox. The read can expose confidential information, representing a confidentiality breach. The flaw corresponds to CWE‑908.

Affected Systems

Google Chrome for Android versions prior to 154.0.8037.57 are affected. The vulnerability arises in the GPU component handling rendering. Devices running any earlier build need patching to close this path.

Risk and Exploitability

The attacker must first compromise the renderer process; once it is compromised, a malicious HTML page can be loaded to trigger the memory read outside the sandbox. No public exploit code is documented and the EPSS score is unavailable. The CVSS score of 3.4 indicates low severity. While the issue is not listed in CISA’s KEV catalog, it still presents a risk in environments where the renderer is already subverted.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to 154.0.8037.57 or newer on all Android devices.
  • Disable GPU acceleration in Chrome to stop the affected GPU resource from being used.
  • Sanitize or isolate all untrusted HTML content to prevent the renderer from processing malicious pages.

Generated by OpenCVE AI on September 30, 2026 at 11:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android
Type Values Removed Values Added
Title Uninitialized Resource Allows Remote Memory Read in Chrome's GPU on Android chromium-browser: chromium-browser: Uninitialized resource in GPU
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Uninitialized Resource Allows Remote Memory Read in Chrome's GPU on Android
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-908
References
Earlier changes (1)
Weaknesses
  • CWE-908

    Use of Uninitialized Resource

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 29, 2026, 9:12 PM
Reserved
Sep 22, 2026, 5:10 AM

View source JSON

Updated
Sep 29, 2026, 9:07 PM

JSON

Status
Analyzed
Published
Sep 29, 2026, 6:17 PM
Modified
Sep 30, 2026, 2:04 PM

View source JSON

Severity
Moderate
Public date
Sep 29, 2026, 5:31 PM

View source Bugzilla JSON

Updated
Sep 30, 2026, 11:45 AM

JSON