Executive brief
A security vulnerability in Google Chrome on Android could allow a malicious website to access sensitive data from other websites. This issue occurs within the browser's graphics processing component and requires an attacker to first compromise a separate part of the browser's security architecture. If successful, an attacker could bypass privacy protections to leak user information across different web origins.
Technical details
An uninitialized variable use (CWE-457) exists within the GPU component of Google Chrome for Android. To exploit this, a remote attacker must first achieve code execution within a compromised renderer process. By then enticing a user to visit a specially crafted HTML page, the attacker can leverage the uninitialized state in the GPU process to bypass Same-Origin Policy (SOP) protections and leak cross-origin data. The vulnerability was addressed in version 148.0.7778.216.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released
- 2026-05-28: disclosed: NVD publication date