CVE-2026-10892: Out of bounds write in GPU in Google Chrome on Android prior to 149

Synopsis

Out-of-bounds write in the GPU component of Google Chrome on Android (versions before 149.0.7827.53) allows a remote attacker to exploit the browser by serving a crafted HTML page. No authentication is required and the only prerequisite is that a user visits the malicious page, making this a network-reachable, low-friction attack. Successful exploitation enables a full sandbox escape, giving the attacker read, write, and denial-of-service capability beyond the browser sandbox. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a crafted HTML page, so the Chrome instance must be reachable or the user must browse to an attacker-controlled URL.

• AuthenticationNot required

  No account, credential, or session token is needed; any anonymous visitor to the malicious page is a valid target.

• Victim interactionRequired

  The attack requires the user to open or be redirected to a crafted HTML page, making a basic social-engineering or malicious-ad delivery step necessary.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in a higher-privilege process on the Android device.
• Confidential data accessible to the Chrome process (stored credentials, session cookies, browsing history) is exposed to the attacker.
• The attacker can write arbitrary data to memory regions outside the intended buffer, enabling modification of application state or persistent storage.
• The affected Chrome process can be crashed or rendered unresponsive, disrupting the user's browsing session.