CVE-2026-17949: Google Chrome GPU Information Leak Flaw

CVE-2026-17949 Overview

CVE-2026-17949 is an uninitialized memory use vulnerability in the GPU component of Google Chrome on Android. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by convincing a user to load a crafted HTML page. Chromium's security team rated the underlying issue Low severity. The weakness maps to [CWE-457: Use of Uninitialized Variable].

The vulnerability enables a browser-based information disclosure. Successful exploitation bypasses the same-origin policy by leaking pixel or buffer data belonging to other origins through the GPU process.

Critical Impact
Remote attackers can leak cross-origin data from GPU memory by serving a crafted HTML page to Chrome on Android users running versions earlier than 151.0.7922.72.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based browsers on Android that share the affected GPU code path
Downstream mobile browsers built on pre-151 Chromium releases

Discovery Timeline

2026-07-30 - CVE-2026-17949 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17949

Vulnerability Analysis

The vulnerability resides in Chrome's GPU process on Android. Code paths in the GPU component read memory before it is properly initialized. That uninitialized memory can contain residual bytes from prior GPU operations, including rendering data from other origins.

Because the GPU process handles compositing and rasterization across all tabs and origins, leaked bytes can cross security boundaries. An attacker-controlled page can influence which uninitialized buffer regions are consumed and how their contents surface back to JavaScript. This turns a memory hygiene bug into a cross-origin read primitive.

The issue is tracked as Chromium Issue #517000034. Google resolved it in the stable channel update announced on the Chrome Releases blog.

Root Cause

The root cause is a GPU-side buffer or variable that is used before being explicitly zeroed or written. Under [CWE-457], code paths execute reads against memory whose contents are undefined by the C++ standard and by the platform allocator. On Android, GPU driver behavior and shared memory reuse increase the likelihood that this memory contains attacker-observable data from previous graphics operations.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome for Android build. The page issues specific graphics operations, such as canvas draws, WebGL calls, or image decodes, that trigger the vulnerable GPU code path. The attacker then reads back rendered output to recover residual bytes belonging to other origins. No elevated privileges and no additional user interaction beyond page navigation are required.

No verified public exploit code is available. Refer to the Chromium Issue #517000034 tracker for technical details as access restrictions are lifted.

Detection Methods for CVE-2026-17949

Indicators of Compromise

Android devices reporting Chrome versions earlier than 151.0.7922.72 in browser telemetry or mobile device management (MDM) inventory
Outbound requests from mobile endpoints to unfamiliar domains hosting HTML pages that heavily exercise WebGL, canvas, or GPU-accelerated APIs
Browser crash reports or GPU process anomalies correlated with visits to untrusted sites

Detection Strategies

Inventory installed Chrome for Android versions across managed mobile fleets and flag any build below 151.0.7922.72
Correlate web proxy or DNS logs with threat intelligence to identify pages designed to abuse GPU rendering paths
Alert on repeated visits by the same device to low-reputation domains that serve WebGL-heavy content

Monitoring Recommendations

Ingest Chrome update status and version data from MDM platforms into a central logging pipeline
Monitor for delayed Chrome update rollouts on Android endpoints past the vendor patch date
Track user reports of unexpected visual artifacts or cross-tab data appearing in web content, which can indicate GPU memory disclosure

How to Mitigate CVE-2026-17949

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce a minimum Chrome version policy in MDM to block or warn non-compliant devices
Restrict browsing to trusted destinations from managed mobile devices until patch deployment is verified

Patch Information

Google addressed CVE-2026-17949 in Chrome 151.0.7922.72 for Android. Patch details are published on the Chrome Releases blog. Downstream Chromium-based Android browsers should apply the corresponding upstream fix.

Workarounds

Disable hardware acceleration in Chrome where feasible to reduce exposure of the vulnerable GPU code path
Use content filtering to block access to untrusted or unclassified domains from managed Android devices
Advise users to avoid opening unsolicited links on mobile devices until updates are confirmed installed

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected patched output:
# versionName=151.0.7922.72