CVE-2026-106370: Uninitialized resource in Google Chrome

This vulnerability involves an uninitialized resource in the GPU component of Google Chrome on Android devices before version 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this flaw by delivering a crafted HTML page that enables reading memory outside the sandbox, potentially exposing sensitive information. The Chromium security team has rated this issue as medium severity. The vendor advisory URL is provided but does not explicitly confirm patch availability in the input data.

A remote attacker with control over the renderer process can read memory outside the sandbox, which may lead to information disclosure. The vulnerability requires prior compromise of the renderer process, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html for current remediation guidance. Until confirmed patched, users should update Chrome on Android to version 155.0.8059.39 or later once available.