Executive brief
Google Chrome for Android is a mobile web browser used to access the internet. A security vulnerability in the browser's graphics processing component could allow a malicious website to bypass security protections. If exploited, an attacker who has already gained a foothold in the browser could take full control of the application, potentially leading to the theft of sensitive user data or unauthorized access to device features.
Technical details
A heap-based buffer overflow (out-of-bounds write) exists in the GPU component of Google Chrome on Android. The vulnerability can be triggered by a remote attacker who has already compromised the renderer process, typically via a specially crafted HTML page. By exploiting this flaw, the attacker can achieve a sandbox escape, moving from the restricted renderer environment to the more privileged GPU process. This issue was addressed in version 149.0.7827.115. Google classifies this as a High severity security issue.
Affected products
- Google Chrome prior to 149.0.7827.115
Timeline
- 2026-05-29: disclosed: Reported by Google internal researchers
- 2026-06-11: patched: Fixed in version 149.0.7827.115
- 2026-06-11: advisory