CVE-2026-13923: GPU Memory Disclosure in Chrome Android—Patch Now

Technical summary

CVE-2026-13923 involves an uninitialized use vulnerability (CWE-457) in Chrome's GPU subsystem on Android. The GPU component fails to properly initialize memory before use, creating a window for information disclosure. When a user visits an attacker-controlled HTML page, malicious JavaScript can interact with the GPU rendering pipeline in ways that leak uninitialized memory contents. The vulnerability requires user interaction (visiting the page) but does not require elevated privileges or unusual browser configurations. The attack surface is the standard web—any webpage the user navigates to can be weaponized.

Business impact

This vulnerability primarily poses a confidentiality risk. Affected Android users could have sensitive information—such as fragments of previously rendered content, cached credentials, or other process memory—exfiltrated without their knowledge. For enterprise deployments using Chrome on Android for work tasks, this could lead to exposure of sensitive documents, emails, or authentication tokens. The attack is silent and leaves no user-visible indication of compromise. Reputational risk exists for organizations managing sensitive data if breaches occur through this vector. The impact is somewhat limited by the requirement for user action and the medium severity rating, but the stealthy nature of the attack merits prompt patching.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are vulnerable. The vulnerability does not affect Chrome on other platforms (Windows, macOS, Linux, iOS) unless those implementations share the same uninitialized GPU memory handling code; however, the CVE description explicitly scopes this to Android. Android devices with affected Chrome versions are at risk if users browse untrusted websites. Both personal and enterprise Android devices running Chrome are in scope.

Exploitability

Exploitability is straightforward for a motivated attacker. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates network accessibility, low attack complexity, and no privilege requirement. The attack does require user interaction—the victim must visit a crafted webpage. There is no evidence this has been exploited in the wild (KEV status is false), but the low barrier to exploitation suggests active exploitation could emerge quickly if public details become available. The attack can be delivered via phishing, malicious ads, or compromised websites. Automated or drive-by exploitation is feasible once the vulnerability mechanism is understood.

Remediation

Users should update Google Chrome on Android to version 150.0.7871.47 or later. This patch addresses the uninitialized GPU memory issue. For enterprise environments, deploy updates via your Mobile Device Management (MDM) solution to enforce compliance. There is no workaround that preserves full functionality; updating is the only remediation. Organizations should prioritize this within their patch cycle given the silent nature of the attack and the ease of exploitation.

Patch guidance

Update Chrome on Android through the Google Play Store, which typically rolls out updates automatically but can be manually triggered by navigating to Settings > About Chrome. Enterprise administrators should verify patch deployment through MDM dashboards and confirm all managed devices are running 150.0.7871.47 or later. Test patching on a representative subset of devices before full rollout if internal testing protocols are in place. Verify patch success by checking Chrome version in Settings > About Chrome; the version should reflect 150.0.7871.47 or a higher version number.

Detection guidance

Detection of exploitation is challenging because the attack is passive—no network signatures, unusual API calls, or crash dumps are guaranteed. Behavioral indicators include: (1) unexpected memory access patterns in Chrome GPU processes (visible in advanced memory forensics); (2) exfiltration of data to attacker-controlled domains immediately after visiting a specific website; (3) anomalous HTTPS traffic to known malicious C2 infrastructure correlated with Chrome usage. Endpoint Detection & Response (EDR) solutions on Android with GPU-level monitoring could flag suspicious interactions, but most mobile EDR has limited visibility into GPU operations. Network-level detection should focus on data exfiltration patterns and anomalous outbound connections from mobile devices. Threat hunting should correlate Chrome visits to suspicious domains with subsequent data transfers.

Why prioritize this

This vulnerability merits timely patching but is not critical. Reasoning: (1) Medium CVSS score and the lack of active exploitation (KEV=false) reduce urgency compared to high-severity flaws; (2) however, the attack is reliable, requires only user interaction, and leaves minimal traces—making post-compromise detection difficult; (3) the vulnerability affects a widely-used platform (Android Chrome) and aligns with known attacker interests in stealing browser memory; (4) enterprises handling sensitive data on mobile should prioritize this above less-critical updates; (5) consumer users should patch within their routine update cadence. Prioritization: deploy within 2-4 weeks for enterprise, within 1-2 months for general users, unless active exploitation emerges.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: high confidentiality impact (C:H) because uninitialized memory can contain arbitrary sensitive data; no integrity or availability impact (I:N/A:N) because the vulnerability is read-only; network attack vector (AV:N) and low complexity (AC:L) indicating ease of reach and exploitation; no privilege requirement (PR:N) and user interaction required (UI:R). The score appropriately captures that this is a stealthy information disclosure that is easy to exploit but does not cause data modification or service disruption. The score does not account for zero-day likelihood or active exploitation prevalence—factors that would elevate practical risk.

Frequently asked questions