CVE-2026-78984: Uninitialized resource in Google Chrome

This vulnerability involves an uninitialized resource in the GPU component of Google Chrome versions prior to 152.0.7977.65. An attacker with control over the renderer process could exploit this flaw to potentially read memory outside the sandbox environment by delivering a crafted HTML page. The issue is classified with a low severity and a CVSS score of 3.4, indicating limited impact. The vulnerability affects Chrome desktop versions before 152.0.7977.65. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

The vulnerability allows a remote attacker who has already compromised the renderer process to potentially read memory outside the sandbox. This could lead to limited information disclosure but does not affect integrity or availability. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until an official fix is confirmed, users should ensure they apply updates promptly once available and avoid interacting with untrusted content that could exploit the renderer process.