CVE-2026-9872: Out of bounds write in GPU in Google Chrome on Android prior to 148

Synopsis

Out-of-bounds write in the GPU component of Google Chrome on Android (versions before 148.0.7778.216) allows a remote attacker to escape the browser sandbox by tricking a user into visiting a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates the attacker requires no authentication and exploits the vulnerability over the network, with only a single user interaction needed. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact beyond the sandbox boundary, enabling code execution in the host process context. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the victim's device must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; any anonymous remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker's crafted HTML page, requiring at least one user action such as clicking a link.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other hard-to-control environmental factors.

Blast Radius

• Attacker escapes the Chrome GPU sandbox and gains code execution in a higher-privilege host process on the Android device.
• Confidentiality is fully compromised: the attacker can read files, session tokens, and application data accessible to the host process.
• Integrity is fully compromised: the attacker can write or modify files, credentials, and persisted application data on the device.
• Availability is fully compromised: the attacker can crash or disable the browser process or other services accessible from the escaped context.