CVE-2026-12030: Out of bounds write in GPU in Google Chrome on Android prior to 149

Synopsis

An out-of-bounds write vulnerability in the GPU component of Google Chrome on Android affects all versions prior to 149.0.7827.115. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to trick the user into visiting a crafted HTML page; it also carries high attack complexity due to the prerequisite renderer compromise. Successful exploitation enables a full sandbox escape, giving the attacker high-impact read, write, and availability control over the host beyond the Chrome sandbox. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target device must be reachable and the user must navigate to the attacker-controlled content.

• AuthenticationNot required

  No account or credentials are required; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The target user must visit a crafted HTML page, making this a social-engineering step the attacker must successfully execute.

• Attack complexityDetail

  Attack complexity is high because exploitation depends on the attacker having already achieved a separate renderer process compromise before the out-of-bounds write can be used for a sandbox escape.

Blast Radius

• The attacker breaks out of the Chrome sandbox, gaining execution context outside the browser's restricted process boundary.
• With sandbox escape achieved, the attacker reads sensitive data stored on the Android device accessible to the Chrome process, including session tokens and cached credentials.
• The attacker writes or modifies files and data on the host beyond what the sandbox normally permits.
• The attacker gains the ability to crash or disrupt the affected Chrome process and potentially dependent services on the device.