CVE-2026-12010: Chrome Android GPU Heap Overflow & Sandbox Escape

Technical summary

CVE-2026-12010 is a heap buffer overflow (CWE-122) in Chrome's GPU rendering subsystem on Android. The vulnerability exists in memory management within the GPU task handling code. Exploitation requires two conditions: (1) prior compromise or control of the renderer process, and (2) user interaction to load a malicious HTML page. A successful exploit could allow an attacker to overwrite heap memory and potentially execute code outside the sandbox context, compromising the entire Android device. The vulnerability affects Chrome on Android prior to version 149.0.7827.115.

Business impact

For organizations deploying Chrome on Android devices, especially in bring-your-own-device (BYOD) or corporate mobile environments, this vulnerability represents a critical risk. Successful exploitation could lead to complete device compromise, exposing sensitive corporate data, credentials stored on the device, and potentially lateral movement within corporate networks. The requirement for renderer compromise means targeted campaigns would likely use multi-stage attacks, making this a concern for organizations with high-value targets or those facing advanced threats. The sandbox escape capability elevates the risk significantly beyond typical browser vulnerabilities.

Affected systems

This vulnerability specifically affects Google Chrome on Android devices running versions prior to 149.0.7827.115. Android versions across all supported releases are potentially impacted if running the vulnerable Chrome version. Chrome on other platforms (Windows, macOS, Linux, iOS) are not affected by this particular GPU buffer overflow. Desktop Chrome installations should verify their version but are not susceptible to this specific flaw.

Exploitability

Exploitation requires a sophisticated attack chain: an attacker must first achieve renderer process compromise (through a separate vulnerability, social engineering, or other means) and then deliver a specially crafted HTML payload. The CVSS vector (AC:H—attack complexity high) reflects this multi-step requirement. While the theoretical attack complexity is high, the presence of this as a critical-severity issue in Chromium suggests realistic exploitation paths exist or are anticipated. The requirement for user interaction (UI:R) means phishing or drive-by download scenarios are plausible delivery mechanisms once renderer compromise is achieved. Currently, this is not listed on the KEV (Known Exploited Vulnerabilities) catalog, though that status may change.

Remediation

Immediate patching is the primary mitigation. Users and administrators must update Chrome on Android to version 149.0.7827.115 or later. For enterprise environments managing Android devices, mobile device management (MDM) solutions should be configured to enforce automatic Chrome updates or restrict users from running outdated versions. In the interim, limiting access to untrusted websites and reducing the attack surface for renderer compromise (via reduced extensions, disable JavaScript on untrusted sites where feasible) provides defense in depth but is not a substitute for patching.

Patch guidance

Update Google Chrome on Android to version 149.0.7827.115 or any subsequent release. For Android device users, the update can be obtained through the Google Play Store; ensure automatic app updates are enabled. For managed enterprise environments, verify your MDM solution can push Chrome updates to enrolled devices and confirm rollout completion. Testing should confirm the updated version is running via Chrome's Settings > About Chrome menu (which also triggers automatic update checks). No interim configuration changes are necessary once the patch is applied; the vulnerability is eliminated by the fix.

Detection guidance

Monitor Chrome version numbers on Android devices through device management tools or mobile threat defense platforms. Network-level detection is limited since exploitation traffic is encrypted within HTTPS/TLS sessions. Endpoint detection tools should flag Chrome versions below 149.0.7827.115 as non-compliant. Behavioral detection of sandbox escape is difficult but may be caught by device integrity monitoring (detection of unexpected privilege escalation or code execution outside app boundaries). Log aggregation from MDM solutions will show update compliance. For incident response, assume any device running vulnerable Chrome that visits untrusted content during the window of vulnerability may require forensic investigation for signs of compromise.

Why prioritize this

This vulnerability merits critical priority for Android-using organizations due to the sandbox escape capability, high CVSS score (8.3), and the broad user base of Chrome on Android. While exploitation requires renderer compromise, the multi-stage attack chain is realistic and the consequences of successful exploitation are severe. The absence of known public exploits (KEV status: false) provides a brief window for patching before active attacks are likely to emerge. Organizations should treat this as a weeks-not-months remediation priority, particularly for high-risk user populations or devices with access to sensitive corporate systems.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH severity) reflects multiple risk factors: (1) network-based attack vector requiring no special access, (2) high attack complexity due to the renderer compromise prerequisite, (3) no privileges required from the attacker, (4) user interaction required (malicious page visit), (5) scope change (the vulnerability can impact resources beyond the vulnerable component—system-wide via sandbox escape), and (6) high impact across confidentiality, integrity, and availability. The score balances the theoretical difficulty of exploitation (AC:H, UI:R) against the severity of impact (sandbox escape, potential device takeover). It does not require active KEV listing to warrant emergency patching; the technical characteristics alone justify urgent action.

Frequently asked questions