Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer… (CVE-2026-106290)

CVE-2026-106290 describes an uninitialized resource vulnerability in the GPU component of Google Chrome on Android versions before 155.0.8059.39. An attacker who has already compromised the renderer process can exploit this flaw to read memory outside the sandbox boundaries via a specially crafted HTML page. The vulnerability is classified under CWE-908 and has a medium severity rating with a CVSS 3.1 base score of 4.7.

The vulnerability allows information disclosure by enabling a remote attacker with renderer process access to read memory outside the sandbox. This could potentially expose sensitive data from the browser's memory. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

A fix is available in Google Chrome for Android version 155.0.8059.39 and later. Users and administrators should update to this version or newer to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the update. No additional mitigations are specified.