Executive brief
A security vulnerability has been identified in Google Chrome for Android that could allow a malicious website to bypass the browser's security 'sandbox.' The sandbox is a critical safety feature designed to prevent malicious code from reaching the rest of your device. If exploited, an attacker who has already gained control over a web page could potentially gain broader access to the underlying mobile operating system, leading to data theft or unauthorized control of the device.
Technical details
A use-after-free (UAF) vulnerability exists in the GPU component of Google Chrome for Android. The flaw is triggered when the browser incorrectly manages memory during graphics processing, specifically after a renderer process has already been compromised. By enticing a user to visit a specially crafted HTML page, a remote attacker can exploit this memory corruption to escape the Chrome sandbox and execute arbitrary code with elevated privileges on the Android system. This vulnerability was addressed in version 150.0.7871.182.
Affected products
- Google Space Chrome prior to 150.0.7871.182
Timeline
- 2026-07-14: other: Reported to Chromium by Google researchers
- 2026-07-21: patched: Fixed in version 150.0.7871.182
- 2026-07-21: advisory: Public advisory published by Google and NVD