CVE-2026-102311: Uninitialized GPU Memory Flaw Enables Chrome-on-Android Sandbox Escape · ZeroHour

CVE-2026-102311

mass

Uninitialized GPU Memory Flaw Enables Chrome-on-Android Sandbox Escape

CVSS 3.1

3.4 low

EPSS

—

Published

Sep 29, 2026 (1d ago)

Modified

Sep 30, 2026

AI analysis

CVE-2026-102311 is an uninitialized resource vulnerability (CWE-908) in the GPU component of Google Chrome on Android, fixed in version 154.0.8037.92. A remote attacker who has already compromised the renderer process can trigger the flaw via a crafted HTML page to read memory outside the browser sandbox, turning a renderer-level bug into a partial sandbox escape with information disclosure. Chromium rates the issue High severity because sandbox escapes are valuable chaining primitives, though the assigned CVSS is only 3.4 (low) since the attacker needs an initial renderer compromise, user interaction, and gains only limited memory read capability. All Chrome users on Android running versions before 154.0.8037.92 are affected; the fix shipped as part of a broader Chrome 154 update covering 32 security flaws. No public proof of concept exists and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation in the wild is not indicated.

What to do: Update Chrome on Android to 154.0.8037.92 or later immediately via the Google Play Store (Settings > About Chrome will confirm the version). Enterprise mobility admins should verify managed Android fleets have pulled the update and check for devices that have disabled Play auto-updates. Because this bug is a second-stage sandbox escape that requires a prior renderer compromise, any suspected exploitation should prompt review for a companion renderer-level vulnerability rather than treating this flaw as a standalone entry point.

Affected

Google Chrome (Android)

< 154.0.8037.92

Estimated exposure

massPotentially hundreds of millions of Android devices, shrinking rapidly via auto-update — Chrome is the default browser on the vast majority of Android's ~3 billion active devices, so any pre-154 unpatched install falls in the exposure pool, though Google Play auto-updates typically remediate most users within days.

Description

Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-908
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-102311

In the news1 stories

Google Chrome 154 Update Fixes 32 Security Flaws Including Critical ANGLE Bug