Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to… (CVE-2026-78986)

CVE-2026-78986 describes an uninitialized resource issue in the GPU component of Google Chrome versions prior to 152.0.7977.65. This flaw could allow a remote attacker, who has already compromised the renderer process, to potentially obtain cross-origin data by delivering a specially crafted HTML page. The vulnerability is associated with CWE-908 (Use of Uninitialized Resource). The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality impact.

The impact is limited to potential disclosure of cross-origin data if the attacker has already compromised the renderer process. There is no indication of integrity or availability impact. The overall severity is low, and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor official Google Chrome security advisories for updates and apply patches once available.