Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer… (CVE-2026-87576)
Source GCVE Database
Not known to be exploited · fixed in 153.0.8010.36 : update affected systems when convenient.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 153.0.8010.36
What to do
AI-suggested
A fix is available in Google Chrome for Android version 153.0.8010.36 and later. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side application, patching the affected software is the recommended mitigation.
Description
An uninitialized resource vulnerability in the GPU component of Google Chrome on Android versions prior to 153.0.8010.36 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox. The vulnerability is rated medium severity by the Chromium security team.
Impact
The vulnerability allows a remote attacker, who has already compromised the renderer process, to read memory outside the sandbox. This could lead to unauthorized disclosure of sensitive information from the browser's memory space. There is no indication of code execution or privilege escalation beyond the renderer compromise. No known exploits in the wild have been reported.
Weaknesses
- CWE-908Use of Uninitialized Resource (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses or accesses a resource that has not been initialized.