Live › vulnerability › CVE-2026-121033
Google Chrome on Android before 157.0.8103.38 has an uninitialized resource bug in its GPU component. A remote attacker who already compromised the renderer process can read memory outside the browser sandbox through a crafted HTML page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Only Chrome on Android before 157.0.8103.38 is named. The attacker must first compromise the renderer process, so this is a second-stage flaw that needs another bug to chain with. Desktop and other platforms are not named in the sources.
No product ranges from the sources yet.
157.0.8103.38.157.0.8103.38Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
This page as .md · .json · in your agent: get_signal("CVE-2026-121033")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.