CVE-2026-13030: Chrome Android GPU Memory Disclosure Vulnerability – CVSS 5.3

Technical summary

CVE-2026-13030 is an uninitialized memory use vulnerability (CWE-457) in Chrome's GPU rendering pipeline on Android. The GPU component fails to zero or properly initialize memory buffers before use, allowing a remote attacker to craft HTML content that triggers GPU operations and leaks the uninitialized memory contents back to the attacker-controlled page context. This memory may contain sensitive data from the same process or adjacent allocations. The vulnerability requires user interaction (visiting a crafted page) and specific hardware/software conditions (reflected in the CVSS AC:H modifier), but once triggered, the attacker gains direct read access to process memory without elevated privileges.

Business impact

Users of Chrome on Android devices face a direct confidentiality risk. If a user visits a compromised or malicious website, attackers could exfiltrate authentication tokens, payment information, or other cached sensitive data stored in Chrome's memory. For organizations managing Android devices in BYOD or corporate environments, this vulnerability could enable credential harvesting attacks against employees, potentially compromising corporate accounts and sensitive communications. The medium CVSS score reflects the user interaction requirement, but the high confidentiality impact makes this a meaningful threat to mobile workforce security postures.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.197 are affected. Android devices running any version of Chrome below the fixed version are in scope, regardless of the underlying Android OS version. Desktop Chrome and Chrome on other platforms are not affected by this specific vulnerability.

Exploitability

Exploitation requires a user to visit a crafted webpage while running a vulnerable version of Chrome on Android. An attacker cannot trigger this remotely without user action, and the attack surface is limited to web-accessible content. The AC:H (high attack complexity) rating indicates that specific conditions or configurations may reduce the practical likelihood of successful exploitation on every device. No public exploit code is currently known or weaponized, and the vulnerability is not yet listed on the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Chrome on Android to version 149.0.7827.197 or later. Verify the installed version via Settings > About Chrome > Version. For users unable to update immediately, avoid visiting untrusted websites and consider disabling GPU acceleration in Chrome settings as a temporary workaround, though this may degrade rendering performance. Organizations managing mobile devices should use Mobile Device Management (MDM) solutions to enforce Chrome updates and restrict access to malicious domains.

Patch guidance

Google has released Chrome 149.0.7827.197 with a fix for this GPU memory initialization issue. Users should check for automatic updates in the Google Play Store; Chrome typically auto-updates on most Android devices. Manual update: open Google Play Store > search 'Chrome' > tap 'Update' if available. Verify the update was successful by navigating to Settings > About Chrome and confirming the version matches or exceeds 149.0.7827.197. Organizations should prioritize this update for any Android device used to access sensitive accounts or services.

Detection guidance

Monitor for unexpected memory access patterns or crashes in Chrome GPU processes on Android devices. Endpoint Detection and Response (EDR) tools with Android support may log GPU driver calls or memory access violations. Web Application Firewalls and threat intelligence feeds can help identify malicious HTML pages known to trigger this vulnerability. User reports of Chrome crashes or unexpected slowdowns on Android should be investigated as potential exploitation attempts. Note: the vulnerability does not trigger an obvious user-visible error; detection relies primarily on patch status verification and behavioral analysis.

Why prioritize this

Although the CVSS score is medium (5.3), prioritize this patch because: (1) Chrome on Android is ubiquitous in corporate and personal use; (2) credential theft via memory disclosure directly undermines authentication security; (3) the fix is already available and straightforward to deploy; (4) uninitialized memory vulnerabilities in GPU drivers are difficult to detect post-exploitation. Organizations should treat this as a high-priority update for any user handling sensitive data or accessing corporate systems from Android devices.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Network-accessible attack vector (AV:N), high attack complexity due to hardware/software conditions (AC:H), no privilege escalation required (PR:N), user interaction mandatory (UI:R), and isolation to the user context (S:U). The high confidentiality impact (C:H) and lack of integrity/availability impact (I:N/A:N) place this in the medium severity range. The AC:H factor acknowledges that successful exploitation depends on specific device configurations or GPU states, though once successful, the information disclosure is complete.

Frequently asked questions