CVE-2026-11085: GPU Integer Overflow in Chrome on Android – Patch Now

Technical summary

CVE-2026-11085 is an integer overflow vulnerability (CWE-190) in the GPU rendering pipeline of Google Chrome on Android prior to version 149.0.7827.53. The flaw resides in GPU memory handling logic and can be triggered via a crafted HTML page that causes integer arithmetic to wrap, resulting in out-of-bounds memory access (CWE-472). The vulnerability is reachable without authentication and with minimal computational complexity; exploitation requires user interaction to visit a malicious or compromised webpage. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact within the affected process scope.

Business impact

This vulnerability directly threatens user data confidentiality and device stability for organizations whose employees use Chrome on Android devices for work. Attackers could harvest sensitive information from browser memory, tamper with cached data or credentials, or render the browser unusable. For enterprises with BYOD policies or relying on Android devices for email and collaboration, delayed patching increases the window for exploitation through phishing campaigns delivering malicious pages. The need for user interaction (clicking a link) makes social engineering a viable attack vector, particularly effective against mobile users who may be less cautious about unexpected links.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.53 are affected. Desktop Chrome versions and Chrome on other platforms are not impacted by this particular flaw. Android devices running affected Chrome versions are at risk, spanning both personally-owned and enterprise-managed devices. Organizations using Mobile Device Management (MDM) solutions should verify Chrome version distribution across their Android fleet.

Exploitability

The vulnerability requires network access and user interaction but is otherwise relatively straightforward to exploit. An attacker needs only to host a malicious HTML page and trick or socially engineer a user into visiting it via a link, advertisement, or embedded content. No special privileges or complex setup are needed on the attacker side. The low attack complexity and lack of authentication requirements make this a practical threat for opportunistic attackers and targeted campaigns alike. However, it is not currently listed in CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not yet been publicly confirmed at scale.

Remediation

Users and administrators must update Google Chrome on Android to version 149.0.7827.53 or later. This update patches the GPU integer overflow. For enterprise environments, push the update through your mobile device management solution or instruct users to manually update via the Google Play Store. Verify the update has been applied by checking Settings > About Chrome. Until patched, users should avoid clicking suspicious links and be cautious of unexpected website redirects.

Patch guidance

Update Google Chrome on Android to 149.0.7827.53 or later. On most devices, this update is available automatically through the Google Play Store; users can manually check for updates by opening Chrome, navigating to Settings > About Chrome, and allowing any pending update to complete. In enterprise environments with Android MDM (such as Google Mobile Device Management or third-party solutions like MobileIron or Intune), deploy the update through your policy engine to ensure consistent coverage. Verify deployment by auditing device compliance reports within your MDM console. Prioritize devices belonging to high-risk users (executives, finance, legal teams) if you cannot update all devices simultaneously.

Detection guidance

Network-level detection is challenging because the malicious payload is embedded in HTML rendered client-side. Focus on endpoint-level monitoring: (1) Log Chrome version information during device compliance scans and flag devices running versions prior to 149.0.7827.53; (2) Monitor for unusual process behavior in Chrome or GPU-related system processes on Android (e.g., unexpected memory access patterns, if your MDM or endpoint protection supports fine-grained visibility); (3) Review user browsing logs for navigation to suspicious or unexpected domains, particularly those not in your organization's whitelist. Consider enabling enhanced safe browsing in Chrome via Group Policy (on managed devices) to surface phishing and malware risks before users click. Behavioral indicators of successful exploitation are difficult to isolate without memory forensics but may include unexpected browser crashes or hangs on specific pages.

Why prioritize this

Although Chromium classifies this as 'Medium' severity internally, the CVSS 3.1 score of 8.8 (HIGH) reflects the real-world impact: remote, low-complexity attack requiring only user interaction, with potential for data exfiltration and integrity compromise. The wide installed base of Chrome on Android and feasibility of social engineering attack vectors justify urgent prioritization. The fact that it has not yet appeared on CISA's KEV list should not lull organizations into complacency; public exploits and adversary interest could emerge quickly once patching details are widely understood.

Risk score, explained

The CVSS 3.1 score of 8.8 is driven by attack vector (Network), attack complexity (Low), privilege requirement (None), and user interaction (Required). The impact ratings—Confidentiality High, Integrity High, Availability High—reflect that successful exploitation can lead to data theft, memory corruption, or denial of service within the scope of the browser process. The 'Unchanged' scope means the impact is contained to Chrome itself and not directly to the underlying Android OS or other applications, slightly moderating an otherwise critical rating. However, compromised browser memory can still contain sensitive user credentials, payment information, and authentication tokens.

Frequently asked questions