{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19146", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2026-08-06T16:51:46.428Z", "datePublished": "2026-08-06T20:33:46.380Z", "dateUpdated": "2026-08-07T00:27:58.918Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "151.0.7922.109", "status": "affected", "lessThan": "151.0.7922.109", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uninitialized Use", "cweId": "CWE-457"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-08-06T20:33:46.380Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html"}, {"url": "https://issues.chromium.org/issues/523713150"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T00:27:54.954001Z", "id": "CVE-2026-19146", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T00:27:58.918Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-19146", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T00:27:54.954001Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T00:27:51.945Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "151.0.7922.109", "lessThan": "151.0.7922.109", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html"}, {"url": "https://issues.chromium.org/issues/523713150"}], "descriptions": [{"lang": "en", "value": "Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-457", "description": "Uninitialized Use"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2026-08-06T20:33:46.380Z"}}}, "cveMetadata": {"cveId": "CVE-2026-19146", "state": "PUBLISHED", "dateUpdated": "2026-08-07T00:27:58.918Z", "dateReserved": "2026-08-06T16:51:46.428Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2026-08-06T20:33:46.380Z", "assignerShortName": "Chrome"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Chrome", "vendor": "Google", "versions": [{"lessThan": "151.0.7922.109", "status": "affected", "version": "151.0.7922.109", "versionType": "custom"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "51E1B0E1-E89A-4166-8412-A395444F42CA", "versionEndExcluding": "151.0.7922.109", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)"}], "id": "CVE-2026-19146", "lastModified": "2026-08-07T14:24:49.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19146", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T00:27:54.954001Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:16:56.770", "references": [{"source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html"}, {"source": "[email protected]", "tags": ["Permissions Required"], "url": "https://issues.chromium.org/issues/523713150"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-457"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "chromium-browser: Google Chrome (Android): Information disclosure via uninitialized GPU memory use", "id": "2512275", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512275"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-824", "details": ["Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)", "A flaw was found in Google Chrome on Android, specifically within its Graphics Processing Unit (GPU) component. A remote attacker, after compromising the browser's renderer process, could exploit an uninitialized memory vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to gain access to potentially sensitive information stored in the browser's memory."], "name": "CVE-2026-19146", "public_date": "2026-08-06T20:33:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-19146\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-19146\nhttps://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html\nhttps://issues.chromium.org/issues/523713150"], "statement": "This Moderate impact information disclosure flaw affects the Chromium component in Red Hat community projects such as Fedora and EPEL. While initially reported for Google Chrome on Android, the underlying vulnerability in the GPU component could allow a remote attacker, after compromising the renderer process, to obtain sensitive information from process memory by enticing a user to visit a specially crafted HTML page.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[151.0.7922.109,151.0.7922.109)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Chrome", "source": "cna", "vendor": "Google"}, "product": "chrome", "vendor": "google"}], "created": "2026-08-07T00:15:04.383369+00:00", "updated": "2026-08-13T14:00:04.480062+00:00", "vendors": ["google", "google$PRODUCT$chrome"]}