CVE-2026-12469: GPU Memory Leak in Chrome Android Allows Data Theft

Technical summary

CVE-2026-12469 is an uninitialized use vulnerability (CWE-457) in the GPU subsystem of Chromium on Android. The flaw stems from improper memory initialization in GPU-related code, allowing a remote attacker to craft a malicious HTML page that, when rendered, can read data from a different origin than the attacking site. The vulnerability exploits the trust boundary between the GPU rendering process and the memory buffers it accesses, potentially exposing uncleared data from previous GPU operations. Chromium rated this as High severity internally; the CVSS 3.1 score of 4.3 reflects the requirement for user interaction and limited scope of impact.

Business impact

Organizations with employees using Chrome on Android devices face elevated risk of credential theft, session hijacking, or exposure of sensitive information displayed in other browser tabs. For example, an attacker could harvest authentication tokens or personal data visible in a financial or email portal while the user interacts with a malicious page in a different tab. This is particularly concerning for remote workforces relying on mobile browsers for business applications. The attack does not grant system-level access or destroy data, limiting the scope to information disclosure, but the ease of triggering it via a web page link increases the practical attack surface.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.155 are vulnerable. This includes all earlier stable and extended-release versions of Chrome for Android. The vulnerability is specific to Android; desktop Chrome versions are unaffected. Users running Chrome 149.0.7827.155 or later have received the fix. This affects a broad user base given Chrome's dominant market share on Android, particularly among enterprise users who rely on mobile browsers for business access.

Exploitability

Exploitability is moderate. The attack requires a user to navigate to or interact with a malicious webpage, making it dependent on social engineering or link-sharing tactics. An attacker cannot remotely force the execution without user action; however, the bar for user interaction is low—a simple click or page load suffices. No special privileges, authentication, or system configuration is required on the victim's side. The attacker need only host a crafted HTML page and distribute the link, making weaponization straightforward for anyone with basic web development skills. The attack does not require heap spray, kernel exploitation, or other complex techniques.

Remediation

Update Google Chrome on Android to version 149.0.7827.155 or later immediately. Google has addressed the uninitialized memory issue in the GPU code path. Users can check their version in Chrome settings under 'About Chrome' and enable automatic updates if not already active. No workarounds are available other than avoiding untrusted web content or temporarily switching to a different browser. Organizations should enforce Chrome auto-update policies and monitor deployment metrics to ensure affected devices are patched.

Patch guidance

Verify Chrome version via Settings > About Chrome; the browser will auto-update if enabled. For enterprise deployments using Google's mobile device management tools, push the latest Chrome version as a mandatory update. On Android 10+, Chrome may also receive updates through Google Play, so verify the Play Store is allowed and updated. Test the patch in your environment before mass deployment if your organization uses Chrome extensions or has custom web applications that depend on GPU rendering behavior, though this vulnerability fix is unlikely to cause compatibility issues. Document the patch deployment date and target completion date (recommend 30 days for most organizations).

Detection guidance

Monitor Chrome crash logs and GPU process errors on managed Android devices for patterns consistent with GPU memory access violations. While network-based detection is limited since the attack uses standard HTTPS traffic to a malicious site, behavioral indicators include: unexpected cross-origin data access patterns in network logs if decrypted/proxied, unusual GPU process restarts, and memory corruption errors in Chrome logs. Educationally, remind users to avoid clicking suspicious links and to verify the sender of any link directing them to unfamiliar sites. Consider network-level blocking of known malicious domains if available. Endpoint detection and response (EDR) solutions on Android 12+ may flag GPU memory access anomalies if configured with GPU-specific rules.

Why prioritize this

This vulnerability merits priority patching because Chrome on Android is ubiquitous in business environments, the attack is trivial to trigger via a web link, and the outcome is sensitive data exposure. While not as critical as remote code execution, cross-origin data leakage directly violates the same-origin policy—a foundational browser security model—and impacts confidentiality of user sessions. The CVSS score of 4.3 reflects low-to-medium priority, but real-world impact in organizations with BYOD policies or mobile-first workforces is higher. The 30–60 day patch window is appropriate unless the organization operates in a high-threat environment or handles regulated data (financial, healthcare) frequently accessed on mobile browsers.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) is assigned because: Attack Vector is Network (user must click a link), Attack Complexity is Low (no special configuration needed), Privileges Required are None, and User Interaction is Required (user must engage with the page). The impact is Confidentiality Low (some data leaks), Integrity None, and Availability None. This reflects a real but limited attack: it leaks data via GPU memory without causing denial of service or allowing the attacker to modify content. The score appropriately downgrades the risk below critical/high because user interaction and data scoping limit the blast radius. However, organizations handling sensitive data on mobile browsers may justify higher internal risk ratings.

Frequently asked questions