CVE-2026-102300: Uninitialized WebGPU Memory Flaw Leaks Cross-Origin Data in Google Chrome · ZeroHour

CVE-2026-102300

mass

Uninitialized WebGPU Memory Flaw Leaks Cross-Origin Data in Google Chrome

CVSS 3.1

4.3 medium

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 29, 2026

AI analysis

Google Chrome versions prior to 154.0.8037.92 contain an uninitialized resource flaw (CWE-908) in the WebGPU graphics API, in which memory is exposed before it is properly initialized. A remote attacker can trigger the bug by getting a victim to visit a crafted HTML page, and the uninitialized WebGPU state can then be used to read data across origin boundaries, breaking the browser's same-origin isolation. The impact is confidentiality-only — the attacker gains access to cross-origin data but cannot modify or crash anything — which is why the CVSS is a modest 4.3 (medium) even though Google's Chromium team rated it High. Everyone running an unpatched Chrome desktop or mobile build is affected; the fix shipped in the Chrome 154 stable update, which patched a total of 32 security flaws. No public proof of concept exists, there are no confirmed reports of exploitation in the wild, and the issue is not on the CISA Known Exploited Vulnerabilities list.

What to do: Update Chrome to 154.0.8037.92 or later immediately (verify via chrome://settings/help); enterprise admins should enforce the update through the Relaunch/Update policies. As a stopgap for endpoints that cannot be patched right away, WebGPU can be disabled via enterprise policy or the chrome://flags toggles. Users of other Chromium-based browsers should apply those vendors' equivalent security updates, since they inherit Chromium's WebGPU code.

Affected

Google Chrome

< 154.0.8037.92

Estimated exposure

mass≈3 billion users (the entire unpatched Chrome install base) — Chrome is the dominant browser with roughly two-thirds of global browser market share and an estimated user base of about 3 billion across desktop and mobile, so essentially every install that has not yet updated to 154.0.8037.92 is…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

Weakness: CWE-908
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102300

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug