CVE-2026-95332

Analyzed Analyzed - Analysis Complete

Use of Uninitialized Variable in Google Chrome on Android

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Chrome

Description

Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95332

EUVD

EUVD-2026-89138

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 154.0.8037.57 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of an uninitialized variable in Tint, a component of Google Chrome on Android. This flaw could allow a remote attacker to read memory outside the sandbox by tricking a user into visiting a specially crafted HTML page.

Detection Guidance

This vulnerability is specific to Google Chrome on Android and involves an uninitialized variable in Tint. Detection would require checking the Chrome version on Android devices. If the version is prior to 154.0.8037.57, the system is vulnerable. No direct commands can detect the vulnerability itself, but you can verify Chrome's version using package managers or app settings.

Impact Analysis

An attacker could exploit this to access sensitive data in memory that should be protected by the sandbox. This may lead to unauthorized data exposure or further system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability allows a remote attacker to read memory outside the sandbox via a crafted HTML page, which could potentially expose sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (health information privacy) by increasing the risk of unauthorized data access or disclosure.

Mitigation Strategies

Update Google Chrome to version 154.0.8037.57 or later to address the uninitialized variable issue in Tint.

Hi! I’m here to help you understand CVE-2026-95332. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70