CVE-2026-11672: Chrome Android GPU Heap Overflow Sandbox Escape

Technical summary

CVE-2026-11672 is a heap buffer overflow (CWE-787) in Chrome's GPU subsystem on Android. The vulnerability allows a sandboxed renderer process to perform an out-of-bounds memory write when processing malicious HTML content. Successful exploitation enables sandbox escape, potentially granting an attacker access to sensitive device resources, other browser processes, or system-level capabilities. The attack requires user interaction (visiting a malicious page) but assumes the renderer process is already under attacker control.

Business impact

For organizations deploying Chrome on Android devices, this vulnerability creates a multi-stage attack risk. While it requires prior renderer compromise, successful exploitation could lead to full device compromise, data exfiltration, lateral movement to corporate resources, and loss of confidentiality and integrity guarantees that the Android sandbox normally provides. Mobile-first enterprises and BYOD programs face elevated risk if users run unpatched Chrome versions.

Affected systems

Google Chrome on Android versions before 149.0.7827.103 are vulnerable. The vulnerability is specific to Android; desktop Chrome versions are not affected by this particular flaw. Any device running an affected Chrome build is at risk if a user visits a malicious website or if the renderer process is compromised through other means.

Exploitability

Exploitability is moderate in practical terms. The attack requires two conditions: (1) a compromised renderer process, and (2) user interaction to load a crafted HTML page. While the barrier to initial renderer compromise may be high, once established, the heap overflow provides a reliable path to sandbox escape. No known public exploit exists at this time, and this vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome on Android to version 149.0.7827.103 or later. The update is available through Google Play Store and should be deployed immediately to all managed Android devices. Organizations should verify update deployment through mobile device management (MDM) tools. For unmanaged devices, user communication emphasizing automatic updates is critical.

Patch guidance

Verify that Chrome on all Android devices is updated to 149.0.7827.103 or a later release. Use MDM solutions (e.g., Google Mobile Management, Microsoft Intune) to enforce automatic updates and prevent rollback. Confirm patch status by checking Settings > About Chrome on target devices, which should display the current version. Set policies to disable manual version downgrades. Test patched builds in a non-production environment before full rollout if your organization uses custom Chrome builds or enterprise policies.

Detection guidance

Monitor Chrome version numbers across your Android device fleet using MDM reporting and telemetry. Look for devices still running versions prior to 149.0.7827.103. Alert on any anomalous GPU process behavior, renderer crashes, or out-of-memory conditions on affected devices, which may indicate exploitation attempts. Endpoint detection tools should flag unsigned or suspicious GPU driver modifications. Correlate Chrome update failures with device compliance reports to identify at-risk machines.

Why prioritize this

This vulnerability merits rapid patching despite not yet appearing in CISA's Known Exploited Vulnerabilities list. The combination of high CVSS score (8.3), sandbox escape potential, and Android's growing attack surface make it a priority. Sandbox escapes are particularly dangerous because they undermine the security boundary Android relies upon. Organizations should treat this as critical for any device handling sensitive data, even though the attack requires prior renderer compromise.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects the severe impact of successful exploitation: high confidentiality, integrity, and availability impact (C:H, I:H, A:H) with sandbox escape capability. The attack vector is network-based (AV:N) and requires high attack complexity (AC:H) due to the need for prior renderer compromise and user interaction (UI:R). The scope change (S:C) acknowledges that compromise extends beyond the renderer sandbox. The score accurately captures the severity while accounting for practical exploitation barriers.

Frequently asked questions