CVE-2026-102300 in Chrome
Summary
by MITRE • 09/29/2026
Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an uninitialized resource issue within the WebGPU implementation of Google Chrome, specifically in versions prior to 154.0.8037.92, represents a significant memory safety flaw that can be exploited by remote attackers to compromise user privacy and data integrity. This defect arises from improper initialization procedures during the allocation or processing of resources managed by the WebGPU API, which is designed to provide high-performance graphics and compute capabilities within web browsers. When an uninitialized resource is accessed without proper validation or default value assignment, it may contain residual data from previous operations or arbitrary memory contents that were not cleared before being exposed to application logic. This state creates a window of opportunity for exploitation where the browser fails to enforce strict boundaries between different execution contexts.
From a technical perspective, this flaw falls under the category of improper initialization vulnerabilities, often mapped to CWE-908 in the Common Weakness Enumeration taxonomy. The core issue lies in the failure to ensure that memory buffers or object states are set to known safe values before they are utilized for rendering or computation tasks involving cross-origin data. In a typical WebGPU workflow, resources such as textures, buffers, and samplers must be carefully managed to prevent leakage of sensitive information across origin boundaries. When initialization is skipped or performed incorrectly, the browser may inadvertently expose memory contents that belong to one web page context to another unrelated context loaded in a different tab or iframe. This bypasses the same-origin policy, which is a fundamental security mechanism designed to isolate content from different sources to prevent malicious scripts on one page from obtaining access to sensitive data on another page.
The operational impact of this vulnerability allows a remote attacker to craft a malicious HTML page that triggers the uninitialized resource condition when rendered by an affected version of Chrome. By leveraging specific WebGPU API calls, the attacker can cause the browser to read or write memory locations that contain cross-origin data, such as cookies, local storage contents, or sensitive form inputs from other websites visited by the user. This capability effectively breaks the isolation model of the web platform, enabling unauthorized access to private information without requiring additional privileges like phishing or social engineering beyond hosting the malicious page. The severity is classified as High because it directly facilitates data exfiltration and undermines trust in the browser's security boundaries, potentially leading to account takeover, identity theft, or further exploitation through subsequent attacks that rely on stolen credentials or session tokens.
Mitigation strategies primarily involve updating Google Chrome to version 154.0.8037.92 or later, where these initialization checks have been corrected and memory safety protocols strengthened within the WebGPU implementation. For organizations managing large fleets of devices, deploying this update via enterprise management tools is critical to closing the exposure window. Additionally, users should be advised to disable JavaScript on untrusted sites if possible, although this is often impractical for general browsing. From a development standpoint, implementing strict input validation and ensuring that all WebGPU resources are explicitly initialized before use can prevent similar issues in custom web applications. Security teams should also monitor for any signs of data exfiltration or unusual network activity originating from browser processes, as these could indicate active exploitation attempts against unpatched systems. The ATT&CK framework categorizes such behavior under techniques involving client-side resource manipulation and cross-site scripting variants that leverage memory corruption to bypass security controls, highlighting the need for robust endpoint detection and response capabilities alongside timely patching cycles.