Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-78977

Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a…

Risk score
50/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
25 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is
Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Affected
Chrome before 152.0.7977.65
Fix
Upgrade Chrome to 152.0.7977.65 or later.
Exploitation
No known exploitation

Story map

Story map: ChromeTHE FLAWSTHE FIXCVE-2026-78977Uninitialized resource in GPU inGoogle Chrome on on Androidprior to 152.0.7977.65…CVSS 6.5 · EPSS 0%CVE-2026-110136Use-after-free can lead toremote code executionCVSS 9.6 · EPSS 0%CVE-2026-106329Incorrect authorisation canlead to remote code executionCVSS 9.6 · EPSS 0%CVE-2026-106417Integer overflow can lead toremote code executionCVSS 9.6 · EPSS 0%Upgrade Chrome152.0.7977.65 · 155.0.8059.79· 155.0.8059.39or later on your release lineWho is exposedChrome before 155.0.8059.79AMBER · PATCH THIS WEEKChromeUse after free in PDF in GoogleChrome prior to 155.0.8059.79allowed a remote attacker toexecute arbitrary code outsidethe sandbox via a crafted HTMLpage. (Chromium securityseverity: Critical)Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.16 Oct · Microsoft Security Response CenterChromium CVE-2026-110136: Use after free16 Oct · Microsoft Security Response CenterChromium CVE-2026-106329: Incorrectauthorization16 Oct · Microsoft Security Response CenterChromium CVE-2026-106417: Integer overflow28 Oct · Microsoft Security Response CenterChromium: CVE-2026-78977 Uninitialized resourcein GPUCONNECTS TOSame weaknessCWE-908 (CWE-908)36 other warnings in 30 days →Same productEarlier Chrome warnings397 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Chrome: Amber, patch this week. Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

The flaws

  • CVE-2026-78977: Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a… (CVSS 6.5 · EPSS 0%)
  • CVE-2026-110136: Use-after-free can lead to remote code execution (CVSS 9.6 · EPSS 0%)
  • CVE-2026-106329: Incorrect authorisation can lead to remote code execution (CVSS 9.6 · EPSS 0%)
  • CVE-2026-106417: Integer overflow can lead to remote code execution (CVSS 9.6 · EPSS 0%)

The fix

Upgrade Chrome: 152.0.7977.65 · 155.0.8059.79 · 155.0.8059.39 or later on your release line

Who is exposed: Chrome before 155.0.8059.79

Where it stands

  • No known exploitation

How it unfolded

  1. 16 Oct, Microsoft Security Response Center (official): Chromium CVE-2026-110136: Use after free
  2. 16 Oct, Microsoft Security Response Center (official): Chromium CVE-2026-106329: Incorrect authorization
  3. 16 Oct, Microsoft Security Response Center (official): Chromium CVE-2026-106417: Integer overflow
  4. 28 Oct, Microsoft Security Response Center (official): Chromium: CVE-2026-78977 Uninitialized resource in GPU

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Last activity 28 Oct 2026. Patch Forecast updates every hour.