CVE-2026-95359: Uninitialized resource in Google Chrome
CVE-2026-95359 is a medium severity vulnerability in Google Chrome on Android prior to version 154.0.8037.57. It involves an uninitialized GPU resource that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. This vulnerability could lead to information disclosure from memory outside the intended sandbox boundaries.
AI Analysis
Technical Summary
This vulnerability arises from an uninitialized resource in the GPU component of Google Chrome on Android versions before 154.0.8037.57. An attacker with control over the renderer process can exploit this flaw by delivering a crafted HTML page, enabling them to read memory outside the sandbox. The flaw is classified with medium severity by Chromium security. The issue affects the GPU resource initialization, potentially leaking sensitive information from memory.
Potential Impact
An attacker who has already compromised the renderer process can exploit this vulnerability to read memory outside the sandbox, potentially exposing sensitive information. The vulnerability does not allow initial compromise but escalates the attacker's ability to access memory beyond intended boundaries.
Mitigation Recommendations
A fixed version of Google Chrome for Android is available at 154.0.8037.57. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-95359: Uninitialized resource in Google Chrome
Description
CVE-2026-95359 is a medium severity vulnerability in Google Chrome on Android prior to version 154.0.8037.57. It involves an uninitialized GPU resource that allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox via a crafted HTML page. This vulnerability could lead to information disclosure from memory outside the intended sandbox boundaries.
Affected software
Chrome
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from an uninitialized resource in the GPU component of Google Chrome on Android versions before 154.0.8037.57. An attacker with control over the renderer process can exploit this flaw by delivering a crafted HTML page, enabling them to read memory outside the sandbox. The flaw is classified with medium severity by Chromium security. The issue affects the GPU resource initialization, potentially leaking sensitive information from memory.
Potential Impact
An attacker who has already compromised the renderer process can exploit this vulnerability to read memory outside the sandbox, potentially exposing sensitive information. The vulnerability does not allow initial compromise but escalates the attacker's ability to access memory beyond intended boundaries.
Mitigation Recommendations
A fixed version of Google Chrome for Android is available at 154.0.8037.57. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-09-22T05:10:43.618Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0856730748.html","vendor":"Google"}]
Threat ID: 6abbf88357f14566d451c8cd
Added to database: 09/29/2026, 17:42:27 UTC
Last enriched: 09/29/2026, 18:00:37 UTC
Last updated: 09/29/2026, 18:07:54 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.