CVE-2026-102303 in Chrome
Summary
by MITRE • 09/29/2026
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an uninitialized resource issue within the GPU subsystem of Google Chrome on Android, specifically affecting versions prior to 154.0.8037.92, represents a significant memory safety flaw that can be exploited by remote attackers. This defect stems from improper initialization of resources allocated for graphics processing operations, which leaves portions of memory in an indeterminate state rather than being explicitly cleared or set to safe default values. When the browser processes certain graphical commands or renders complex web content involving GPU acceleration, it may read from these uninitialized memory regions without validating their contents first. This behavior creates a classic use-of-uninitialized-variable scenario where sensitive data previously stored in that memory location can be inadvertently exposed during subsequent operations.
From a technical perspective, this flaw falls under the category of CWE-908, which describes the use of uninitialized resource. In the context of modern web browsers like Chrome, the GPU process operates with elevated privileges relative to standard renderer processes to handle hardware-accelerated rendering efficiently. When an attacker crafts a malicious HTML page that triggers specific WebGL or Canvas operations requiring GPU resources, they can manipulate the timing and allocation patterns to force the browser into reading stale data from memory buffers intended for other purposes. This allows the attacker to bypass same-origin policies by extracting cross-origin data such as cookies, session tokens, or sensitive form inputs stored in adjacent memory locations that were not properly sanitized before reuse.
The operational impact of this vulnerability is severe because it enables a remote code execution-like scenario where an untrusted website can exfiltrate private user information without any interaction beyond visiting the crafted page. This constitutes a cross-origin data leakage attack, which undermines the fundamental security model of web browsers designed to isolate content from different origins. An attacker could potentially steal authentication credentials, track user activity across sites by reading session identifiers, or gather other personally identifiable information that was left in memory after previous browsing sessions. The severity is rated as High due to the ease with which this can be triggered via standard web technologies and the high value of the data at risk.
This vulnerability aligns with ATT&CK technique T1056.004, specifically Data from Memory using Browser or Web Service APIs, where adversaries harvest credentials and other sensitive information directly from memory rather than through traditional keylogging or phishing methods. It also relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, as the core issue is the unintended disclosure of internal browser state to external malicious scripts. The exploitation does not require user interaction beyond loading a webpage, making it particularly dangerous in environments where users frequently visit untrusted or compromised websites.
Mitigation for this vulnerability primarily involves updating Google Chrome on Android to version 154.0.8037.92 or later, which includes patches that ensure proper initialization of GPU resources before they are used by rendering pipelines. Developers and security teams should also enforce strict content security policies to limit the capabilities of embedded scripts and consider deploying browser extensions that restrict access to sensitive APIs when possible. For enterprise environments, ensuring automatic update mechanisms are enabled is critical to maintaining protection against such memory safety vulnerabilities as new exploits emerge rapidly in the wild. Regular auditing of third-party libraries used within web applications can also help reduce the attack surface by minimizing dependencies on potentially vulnerable components.