Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2026-106290: Chrome Android before 155.0.8059.39 can leak memory
CVE-2026-106290 · published 29 days ago
Summary
The Android version of Google Chrome (and the Debian Chromium package) released before version 155.0.8059.39 may allow a malicious web page to read data from other parts of the device's memory. This could expose sensitive information if an attacker already controls a web page. Install the latest Chrome/Chromium update to close the gap.
What to do
- Update google chrome to version 155.0.8059.39 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome | < 155.0.8059.39 | |
| Debian:12 | debian | chromium | All versions |
Original advisory text
DEBIAN-CVE-2026-106290
Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.7
Medium
Type
CWE-908Use of Uninitialized Resource
Timeline
Published6 Oct 2026
Updated4 Nov 2026
First seen6 Oct 2026
Track software like this
Free during beta