Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via… (CVE-2026-87555)
Source GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 04:40:14 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until a fix is available, users should exercise caution when visiting untrusted websites on affected Chrome versions.
Description
An uninitialized resource vulnerability in the GPU component of Google Chrome on Android versions prior to 153.0.8010.36 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The vulnerability is rated medium severity by Chromium security. There are no known exploits in the wild and no patch information is provided in the available data.
Impact
A remote attacker can read memory outside the sandbox on affected versions of Google Chrome for Android, potentially exposing sensitive information. However, no active exploitation or known exploits have been reported, limiting immediate risk.
Weaknesses
- CWE-908Use of Uninitialized Resource (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses or accesses a resource that has not been initialized.