CVE-2026-13969: Chrome Android Memory Disclosure via Uninitialized UI Variable

Technical summary

CVE-2026-13969 is classified as CWE-457 (Use of Uninitialized Variable) affecting the UI layer in Chromium-based Chrome on Android. The vulnerability allows information disclosure when uninitialized memory regions are accessed and exposed to a remote attacker via a crafted HTML page. The attack requires renderer process compromise as a prerequisite, meaning the attacker must have already exploited a separate vulnerability or achieved code execution within Chrome's sandboxed renderer context. The CVSS 3.1 score of 5.3 (Medium) reflects the requirement for user interaction and high attack complexity, balanced against the potential for confidential information disclosure.

Business impact

Organizations with employees using Chrome on Android devices face a secondary information disclosure risk if their devices are already compromised. The threat is amplified in environments where users visit untrusted websites or where malware has gained renderer-level access. While the direct attack surface is limited—requiring prior compromise—the vulnerability increases the blast radius of initial compromises by enabling data exfiltration from Chrome memory, potentially including cached credentials, session tokens, or other sensitive information processed by the browser.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.47 are affected. This includes all stable, beta, and development channel releases of Chrome for Android below this version threshold. Android devices running affected Chrome versions face the vulnerability risk. Verify your Chrome version in Settings > About Chrome to determine exposure status.

Exploitability

Direct exploitation requires two conditions: (1) the renderer process must already be compromised through a separate attack, and (2) the user must visit a page controlled by the attacker. The high attack complexity score reflects the prerequisite renderer compromise, which itself requires exploitation of another vulnerability or sophisticated social engineering. While not directly exploitable by unauthenticated remote attackers against uncompromised systems, the vulnerability significantly amplifies the value of any renderer-level compromise, making it a meaningful concern in targeted scenarios.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. This patch addresses the uninitialized memory access in the UI component. Users should enable automatic updates in the Google Play Store to ensure timely patching. Organizations managing Android devices should enforce Chrome version policies and verify deployment of patched versions across their mobile device fleet.

Patch guidance

Chrome on Android typically auto-updates through the Google Play Store. Verify the update has been applied by navigating to Settings > About Chrome; the version number should display 150.0.7871.47 or higher. For enterprise deployments, consult Chrome enterprise documentation for managed update policies and verification procedures. Unpatched versions present ongoing risk if devices access untrusted content or are exposed to renderer exploits.

Detection guidance

Detection is challenging because this vulnerability requires renderer process compromise as a prerequisite. Monitor for anomalous Chrome renderer behavior, unexpected memory access patterns, or signs of prior compromise (such as unauthorized code execution indicators). Security teams should prioritize detection and response for the initial renderer-level exploits rather than this secondary information disclosure. On Android, Mobile Threat Defense (MTD) solutions monitoring process-level behaviors may flag suspicious renderer activity. Review Chrome security logs if available in enterprise environments for signs of exploitation attempts.

Why prioritize this

Despite a Medium CVSS score, prioritization should focus on the prerequisite compromise required. Organizations should assess their renderer exploit mitigation posture and treat patching as part of routine Chrome maintenance rather than emergency response. However, environments with confirmed or suspected renderer-level compromises should treat this patch as urgent to prevent data exfiltration. The relatively low exploitability bar once renderer access exists elevates importance in high-risk threat environments.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects: high confidentiality impact (C:H) offset by attack complexity requiring renderer process compromise and user interaction (AC:H, UI:R), with no integrity or availability impact. The score appropriately captures that while the information disclosure potential is significant, the attack pathway is constrained. Organizations with higher baseline compromise risk or sensitive data processing in Chrome should consider this vulnerability more severe than the base score suggests.

Frequently asked questions