CVE-2026-87555 describes a vulnerability in Google Chrome on Android where an uninitialized GPU resource can be exploited by a remote attacker to read memory outside the sandbox environment. The attack vector involves a crafted HTML page that triggers this uninitialized resource condition. The vulnerability is categorized under CWE-908 (Use of Uninitialized Resource). The affected versions are all versions prior to 153.0.8010.36, although this is not explicitly stated in the input data as an affectedVersions entry. No CVSS score is provided, and no vendor advisory or patch information is included in the source data.

A remote attacker can read memory outside the sandbox on affected versions of Google Chrome on Android, potentially exposing sensitive information. The vulnerability does not indicate code execution or privilege escalation but allows unauthorized memory disclosure. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Google Chrome security channels for updates and apply the update to version 153.0.8010.36 or later once available.