Executive brief
Google Chrome on Android contained an uninitialized GPU resource that allowed remote attackers to read memory outside the browser sandbox. An attacker could craft a malicious HTML page that, when visited by a user, would leak sensitive data from the browser process, potentially exposing user credentials, browsing history, or other sensitive information.
Technical details
This vulnerability is an uninitialized resource in the GPU component of Google Chrome on Android prior to version 153.0.8010.36. An uninitialized resource means a GPU object or buffer was not properly initialized before use, leaving it containing unpredictable data from previous memory allocations. The vulnerability allows an out-of-bounds memory read, enabling a remote attacker to read data outside the sandbox boundary via a crafted HTML page. No user interaction beyond visiting a malicious webpage is required. The vulnerability was patched in Chrome 153.0.8010.36 for Android and corresponding desktop versions (153.0.8010.36/37 for Windows/Mac and Linux).
Affected products
- Google Chrome prior to 153.0.8010.36 on Android
Timeline
- 2026-09-08: patched: Fixed in Chrome 153.0.8010.36
- 2026-09-09: disclosed: Published on NVD