CVE-2026-95359 describes an uninitialized resource vulnerability in the GPU of Google Chrome on Android platforms before version 154.0.8037.57. This flaw enables a remote attacker, after compromising the renderer process, to read memory outside the sandbox boundaries by delivering a specially crafted HTML page. The vulnerability is categorized under CWE-908 (Use of Uninitialized Resource). No CVSS score is provided, but the Chromium security team rates it as medium severity.

The vulnerability allows a remote attacker with control over the renderer process to read memory outside the intended sandbox, potentially exposing sensitive information. However, exploitation requires prior compromise of the renderer process, limiting the attack vector. The medium severity rating reflects a moderate risk of information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should update Google Chrome on Android to version 154.0.8037.57 or later once available. Until then, limiting exposure to untrusted web content and maintaining updated security controls is advisable.