CVE-2026-102307: Uninitialized Memory Read in Dawn (WebGPU) in Google Chrome for Android · ZeroHour

CVE-2026-102307

mass

Uninitialized Memory Read in Dawn (WebGPU) in Google Chrome for Android

CVSS 3.1

4.7 medium

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

An uninitialized resource flaw (CWE-908, use of uninitialized memory) in Dawn, the WebGPU graphics engine built into Chrome, allowed a remote attacker to read memory outside the browser sandbox when a victim on Android visits a crafted HTML page. Triggering it requires user interaction — luring the user to a malicious webpage — and the impact is limited to confidentiality (reading out-of-sandbox memory), with no direct integrity or availability effect, which is why NVD scores it 4.7 (medium) despite Google's High severity rating. Only Google Chrome on Android prior to version 154.0.8037.92 is listed as affected; the fix shipped as part of the Chrome 154 stable update that resolved 32 security flaws. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Update Chrome on Android to version 154.0.8037.92 or later via the Google Play Store and confirm automatic updates are enabled. Enterprise and mobility admins should verify that managed Android fleets have pulled the Chrome 154 update. Because exploitation requires visiting a crafted page, users should avoid untrusted links on unpatched devices until updated.

Affected

Google Chrome for Android (Dawn WebGPU component)

< 154.0.8037.92

Estimated exposure

mass≈2–3 billion users (Chrome is the pre-installed default browser on roughly 3 billion active Android devices) — Chrome ships as the default browser on Android, which has on the order of 3 billion active devices, so the pre-patch install base plausibly numbers in the billions, though Google Play auto-updates shrink the vulnerable population within…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-908
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102307

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug