CVE-2026-11085: Integer overflow in GPU in Google Chrome on Android prior to 149

Synopsis

An integer overflow in the GPU component of Google Chrome on Android (versions before 149.0.7827.53) allows a remote attacker to trigger out-of-bounds memory access by luring a user to a crafted HTML page. The attack is reachable over the network and requires no authentication, but does require the victim to visit a malicious page. Successful exploitation gives an attacker read and write access to process memory and can crash the browser. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page served from any internet-accessible host.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated visitor to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker must socially engineer a click, redirect, or ad delivery to reach the vulnerable code path.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads arbitrary memory from the Chrome GPU process, which may include cached page content, authentication tokens, or other sensitive in-memory data.
• The attacker writes to out-of-bounds memory regions, enabling modification of internal browser state or escalation toward code execution within the renderer or GPU process.
• The overflow can corrupt process memory in ways that crash the Chrome browser, causing a denial of service for the affected user session.
• On Android, a compromised GPU process may serve as a stepping stone for further sandbox escape attempts targeting the underlying OS.