CVE-2026-12010: Heap buffer overflow in GPU in Google Chrome on Android prior to 149

Synopsis

A heap buffer overflow in the GPU component of Google Chrome for Android allows a remote attacker who has already compromised the renderer process to escape the browser sandbox. The vulnerability is reachable over the network, requires no authentication, but does require the victim to visit a crafted HTML page, and the attacker must already control the renderer process, making this a high-complexity exploit chain. Successful exploitation grants the attacker full control beyond the sandbox boundary, enabling arbitrary code execution, data theft, and tampering on the affected device. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's device to be reachable via a browser session initiated from a remote origin.

• AuthenticationNot required

  No account, credential, or session token is needed; the attack is launched from an unauthenticated remote origin against any visiting user.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or a malicious ad/link a necessary step in the attack chain.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already compromised the renderer process as a precondition before the GPU overflow can be used to escape the sandbox.

Blast Radius

• Attacker escapes the Chrome sandbox boundary and gains code execution in the broader Android process context outside the renderer jail.
• Confidential data accessible to the Chrome process, including stored credentials, session cookies, and browsing history, becomes readable to the attacker.
• The attacker can write or modify data within the scope of the compromised process, including cached files and application storage.
• The affected Chrome process and dependent services can be crashed or destabilized, causing denial of service for the browser session.