CVE-2026-9889: Out of bounds read and write in Dawn in Google Chrome on Android prior to 148

Synopsis

Out-of-bounds read and write in the Dawn graphics subsystem of Google Chrome on Android (versions prior to 148.0.7778.216) allows a remote attacker to escape the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, and relies on a user visiting a malicious page. Successful exploitation grants the attacker code execution outside the Chrome sandbox, with full confidentiality, integrity, and availability impact on the host. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a victim to a remotely hosted crafted HTML page, so the Chrome instance must be reachable via normal web browsing.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker may need to satisfy specific race conditions or environmental factors in the Dawn graphics layer to reliably trigger the out-of-bounds access and complete the sandbox escape.

Blast Radius

• Successful exploitation escapes the Chrome sandbox, giving the attacker code execution in the context of the host process on the Android device.
• The attacker reads sensitive data accessible to the Chrome process, including stored credentials, session tokens, and browsing history.
• The attacker writes to or modifies data and state outside the sandbox boundary, enabling persistent changes to application or OS-level data.
• The attacker disrupts availability of the affected application or broader device services by crashing processes or exhausting resources outside the sandbox.