Loading vulnerability…
Uninitialized Memory Disclosure in Google Chrome for Android GPU Component
CVE-2026-19146 is an uninitialized-use vulnerability in the GPU component of Google Chrome on Android before version 151.0.7922.109. A remote attacker who has already compromised the renderer process can use a crafted HTML page to obtain potentially sensitive information from process memory. Chromium classifies the vulnerability as High severity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose potentially sensitive information held in process memory. Exploitation requires an existing renderer-process compromise; this vulnerability alone does not establish initial renderer compromise or arbitrary code execution.
If you can’t patch tonight, do this now.
Apply the vendor patch as the primary mitigation. Until updates are fully deployed, reduce exposure by limiting use of vulnerable Chrome on Android builds, enforcing rapid browser update policies, minimizing exposure to untrusted web content, and using least-privilege and platform sandboxing controls to reduce the value of post-renderer-compromise information disclosure. No specific temporary workaround for the vulnerable code path is currently available.
Patch, then assume compromise.
Upgrade Google Chrome on Android to version 151.0.7922.109 or later. Restart Chrome after updating and verify that the fixed version is deployed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.