CVE-2026-10008: Chrome Android GPU Memory Disclosure Vulnerability

Technical summary

CVE-2026-10008 is an uninitialized-use vulnerability (CWE-457) in Chrome's GPU graphics subsystem on Android. The flaw stems from the GPU renderer failing to initialize memory before use, creating a window where stale data from prior GPU operations remains accessible to a web page. By crafting HTML that triggers specific GPU operations, an attacker can read uninitialized buffer contents and infer sensitive information about the browser process memory layout and cached data. The vulnerability requires user interaction (the user must visit a malicious page) but no special privileges. The attack surface is high because any HTML page served via http/https can attempt exploitation.

Business impact

Organizations whose users rely on Chrome for Android for business purposes face information disclosure risk. For individuals: credential theft, session hijacking, and exposure of cached sensitive information. For enterprises: compromised browser-based access to email, cloud services, and internal web applications. The non-critical severity rating reflects the need for user interaction, but the attack is passive from the user's perspective—they simply visit a webpage. Android deployments are particularly common in BYOD environments, multiplying the exposure.

Affected systems

Google Chrome on Android versions prior to 148.0.7778.216. Desktop Chrome and other Chromium-based browsers on Android (such as Edge, Samsung Internet if built on affected Chromium base) may have similar exposure depending on their versioning and patch cadence. The vulnerability does not affect Chrome on Windows, macOS, Linux, or iOS based on the published advisory scope.

Exploitability

Exploitability is moderate. An attacker must craft a specific HTML page and socially engineer or advertise it to target users. No special network conditions, advanced browser exploits, or privilege escalation are required. The attack does not crash the browser or leave obvious traces. However, the attacker's ability to reliably extract *specific* sensitive data (e.g., a particular credential) is limited by randomization and the probabilistic nature of uninitialized memory—useful for reconnaissance or side-channel attacks but not guaranteed exploitation of a known target value.

Remediation

Chrome on Android must be updated to version 148.0.7778.216 or later. Users should enable automatic updates in Chrome settings (Menu > Settings > About Chrome). Organizations managing Android devices via Mobile Device Management (MDM) should push the update through their management console. There is no workaround for unpatched devices other than avoiding untrusted websites or disabling JavaScript, both impractical for normal use.

Patch guidance

Apply Chrome update 148.0.7778.216 or any subsequent stable release. Verify the installed version in Settings > About Chrome; the app will automatically check for updates. If automatic updates are disabled, manually open Settings > About Chrome to trigger an immediate check. Organizations using Android Enterprise should confirm that managed devices are configured to receive the latest Chrome version; use the Google Play app version or bundled Chromium, not sideloaded builds. Test updates on a representative device before rolling out org-wide to catch compatibility issues.

Detection guidance

Endpoint Detection and Response (EDR) tools cannot reliably detect exploitation attempts because the attack is carried out within a sandboxed browser process and leaves minimal forensic artifacts. Monitor Chrome update adoption rates via MDM dashboards to ensure timely patching. Log collection from web proxies can identify attempts to visit known malicious campaign sites, though the malicious HTML itself may be hosted legitimately or via compromised servers. Consider blocking or warning on JavaScript-heavy pages from untrusted sources if your organization can tolerate that friction. Memory forensics post-incident might reveal GPU buffer artifacts, but this is not a practical ongoing detection method.

Why prioritize this

CVE-2026-10008 warrants urgent patching (prioritize within 1–2 weeks) despite the CVSS 6.5 medium score, because: (1) it affects a mainstream consumer-facing application with billions of users; (2) the attack requires no special privileges or network conditions; (3) information disclosure can enable credential or session theft; (4) Chrome's update velocity is fast, making the patch deployment straightforward. However, it does not warrant emergency (same-day) patching because exploitation requires user interaction and delivered data is non-deterministic, limiting its appeal for mass attacks or ransomware campaigns.

Risk score, explained

CVSS 6.5 (Medium) reflects: High Confidentiality impact (information disclosure from process memory), No Integrity or Availability impact (read-only), Network-accessible attack vector, Low complexity attack (crafted HTML page), and Required User Interaction (user must visit the malicious page). The score appropriately discounts exploitation likelihood due to the need for social engineering. However, the Chromium security team rated it 'High' severity, which may indicate context-specific concern (e.g., prevalence of Android Chrome in targeted regions, feasibility of reliable data extraction in practice, or downstream attack chains).

Frequently asked questions