CVE-2026-78977 Overview
CVE-2026-78977 is an uninitialized resource vulnerability in the GPU component of Google Chrome on Android. Versions prior to 152.0.7977.65 are affected. A remote attacker can exploit the flaw by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to read memory contents inside the Chrome sandbox. The issue is classified under [CWE-908: Use of Uninitialized Resource]. Chromium engineers assigned this issue a security severity of Low, while NVD scored it as Medium. Exploitation requires user interaction, specifically the victim visiting attacker-controlled web content.
Critical Impact
A remote attacker can read memory inside the Chrome sandbox on Android by luring a user to a crafted HTML page, potentially exposing sensitive process data.
Affected Products
- Google Chrome for Android prior to 152.0.7977.65
- Chromium GPU process component
- Downstream Chromium-based Android browsers using the affected build
Discovery Timeline
- 2026-08-25 - CVE-2026-78977 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78977
Vulnerability Analysis
The flaw resides in Chrome's GPU process, which handles graphics acceleration and compositing for web content. The GPU process allocates buffers and resources that are consumed by rendering pipelines. When one of these resources is used before initialization, the contents reflect prior memory state left in the allocation. An attacker who crafts specific GPU workloads through HTML, WebGL, or related web APIs can trigger the code path that consumes the uninitialized data. The resulting memory contents can then be read back through observable side channels such as rendered pixels or exposed buffer reads. Because the disclosure occurs inside the sandbox, the attacker gains information only about the GPU process itself, not the wider system.
Root Cause
The root cause is a missing initialization step on a GPU resource in the Chromium codebase, aligning with [CWE-908]. Memory returned by the allocator retains residual data from prior use, and the code path in question reads that memory before writing valid values. Details are tracked in the Chromium Issue Tracker Entry.
Attack Vector
Exploitation is network-based and requires user interaction. The victim must load an attacker-controlled HTML page in a vulnerable Chrome build on Android. The page delivers a crafted rendering workload that exercises the vulnerable GPU code path. The attacker then extracts residual memory content leaked through the rendering pipeline. No authentication or elevated privileges are required.
No verified public exploit or proof-of-concept code is available for this issue. Refer to the Google Chrome Stable Update for vendor disclosure details.
Detection Methods for CVE-2026-78977
Indicators of Compromise
- Android Chrome clients reporting a version string earlier than 152.0.7977.65 in browser telemetry or user-agent logs.
- Outbound HTTP(S) requests from mobile fleets to untrusted domains hosting GPU-heavy or WebGL-intensive HTML pages.
- Unusual GPU process crashes or renderer instability preceding data exfiltration attempts.
Detection Strategies
- Enumerate installed Chrome versions across managed Android devices and flag builds below 152.0.7977.65.
- Inspect mobile web proxy logs for pages that combine WebGL or canvas workloads with cross-origin data-return channels.
- Correlate GPU-process crash reports on Android with sessions visiting newly registered or low-reputation domains.
Monitoring Recommendations
- Ingest Android endpoint and MDM inventory data into a centralized data lake to track Chrome version drift.
- Monitor DNS and web gateway telemetry for known malicious domains distributing browser exploitation kits.
- Alert on repeated tab crashes or gpu-process failures reported by mobile browser telemetry.
How to Mitigate CVE-2026-78977
Immediate Actions Required
- Update Google Chrome for Android to version 152.0.7977.65 or later through the Google Play Store.
- Push the updated Chrome build through Mobile Device Management (MDM) to enforce compliance across managed fleets.
- Advise users to avoid opening untrusted links on Android until the patched Chrome build is confirmed installed.
Patch Information
Google addressed the issue in Chrome for Android 152.0.7977.65. The fix is included in the stable-channel update announced in the Google Chrome Stable Update. Chromium tracking details are available in the Chromium Issue Tracker Entry.
Workarounds
- Restrict browsing on Android endpoints to trusted domains using enterprise web filtering until patching is complete.
- Disable hardware acceleration in Chrome flags where operationally feasible to reduce exposure of the vulnerable GPU code path.
- Use MDM policies to block installation of outdated Chrome versions and enforce automatic updates on managed devices.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
