CVE-2026-106290: Uninitialized resource in Google Chrome

This vulnerability arises from an uninitialized resource in the GPU component of Google Chrome on Android devices before version 155.0.8059.39. An attacker who has compromised the renderer process can exploit this flaw by delivering a specially crafted HTML page, enabling them to read memory outside the intended sandbox environment. The issue is classified with medium severity by Chromium security. No CVSS score is provided. The vendor advisory linked indicates a stable channel update addressing this issue.

The vulnerability allows a remote attacker with control over the renderer process to read memory outside the sandbox, potentially exposing sensitive information. This compromises the isolation guarantees of the sandbox but does not indicate direct code execution or privilege escalation beyond the renderer compromise.

A fix is available in Google Chrome version 155.0.8059.39. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory for details: https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html