CVE-2026-11082: Race in GPU in Google Chrome on Android prior to 149

Synopsis

This is a race condition in the GPU process of Google Chrome for Android, affecting all versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page; however, the attacker must have already compromised the renderer process as a prerequisite. Successful exploitation achieves a sandbox escape, giving the attacker full read, write, and availability impact outside the Chrome sandbox with effects crossing into the broader system scope. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is needed; the attack is launched against an unauthenticated browser session.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making social engineering or malicious ad delivery the likely delivery vector.

• Attack complexityDetail

  Although the underlying trigger is a race condition, the CVSS vector rates attack complexity as Low, indicating the exploit is considered reliable and does not depend on specific environmental conditions beyond the renderer compromise prerequisite.

Blast Radius

• Attacker escapes the Chrome sandbox and gains execution context outside the renderer, breaking the primary security boundary of the browser.
• Confidentiality is fully compromised: the attacker can read files, credentials, session tokens, and any data accessible to the Chrome process or the underlying OS user.
• Integrity is fully compromised: the attacker can write or modify files, inject code into other processes, and persist malicious payloads on the device.
• Availability is fully compromised: the attacker can crash, terminate, or otherwise disrupt Chrome and other processes running under the same user account.