Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer… (CVE-2026-106370)

CVE-2026-106370 describes an uninitialized resource issue in the GPU of Google Chrome on Android before version 155.0.8059.39. This flaw permits a remote attacker, with control over the renderer process, to read memory outside the sandbox boundaries by leveraging a specially crafted HTML page. The vulnerability is classified under CWE-908 (Use of Uninitialized Resource) and has a medium severity level according to Chromium's security assessment.

The vulnerability allows information disclosure by enabling a remote attacker who has already compromised the renderer process to read memory outside the sandbox. This could potentially expose sensitive data from the browser's memory space. There is no indication of integrity or availability impact, and no known exploits are reported in the wild.

A fix is available in Google Chrome for Android version 155.0.8059.39 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated.