CVE-2026-12028: Use after free in GPU in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability in the GPU component of Google Chrome on Android affects all Chrome versions prior to 149.0.7827.115. The flaw is reachable over the network by a remote attacker who has already compromised the renderer process, with no authentication required but requiring victim interaction via a crafted HTML page. Successful exploitation enables a sandbox escape, granting the attacker capabilities beyond the Chrome renderer sandbox including high-impact read, write, and availability effects on the host. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, requiring over-the-network exposure to the target.

• AuthenticationNot required

  No authentication or account credentials are required; the attacker operates as an unauthenticated remote party.

• Victim interactionRequired

  The victim must visit or load a crafted HTML page, making this a social-engineering vector requiring at least one user action.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must first have compromised the renderer process before leveraging this flaw, introducing a prerequisite environmental condition.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, gaining execution capabilities outside the restricted process boundary.
• Confidential data accessible to the Chrome process on the Android device, including stored credentials, session tokens, and browsing data, becomes readable.
• The attacker can write or modify data within the scope accessible after the sandbox escape, including files and application state on the device.
• The availability of the Chrome process and potentially dependent application services can be disrupted or crashed.