Executive brief
Google Chrome on Android is vulnerable to a security flaw in its graphics translation component. A remote attacker could exploit this by tricking a user into visiting a specially crafted website. If successful, the attacker could potentially bypass the browser's security sandbox, which is designed to prevent malicious code from accessing the rest of the device and its data.
Technical details
An out-of-bounds (OOB) read and write vulnerability exists in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome for Android. The flaw is triggered when the browser processes a specially crafted HTML page, leading to memory corruption. A remote, unauthenticated attacker can leverage this to achieve a sandbox escape, potentially allowing for arbitrary code execution outside of the browser's restricted environment. The issue was addressed in Chrome version 150.0.7871.182.
Affected products
- Google Chrome Prior to 150.0.7871.182
Timeline
- 2026-06-13: disclosed: Reported by Google internal researchers
- 2026-07-21: patched: Fixed in version 150.0.7871.182
- 2026-07-21: advisory