CVE-2026-12028: Chrome Android GPU Use-After-Free Sandbox Escape Vulnerability

Technical summary

CVE-2026-12028 is a use-after-free vulnerability (CWE-416) in the GPU rendering subsystem of Chrome on Android. The vulnerability exists in versions prior to 149.0.7827.115. A remote attacker operating from a compromised renderer process can trigger a memory safety error where freed GPU memory is referenced again, resulting in potential code execution with the privileges of the GPU process. The attack vector requires user interaction (opening a crafted HTML page) and high attack complexity, but succeeds in crossing security boundaries (changing scope to system-level impact).

Business impact

If exploited, this vulnerability could allow attackers to move laterally from a compromised browser process to underlying system components, potentially leading to device takeover, unauthorized data access, or malware installation. For organizations deploying Chrome on Android endpoints (BYOD scenarios, managed tablets, etc.), this represents a post-compromise escalation risk that elevates browser exploits to OS-level threats. The impact is heightened in environments where Chrome is used to access sensitive corporate services.

Affected systems

Google Chrome on Android devices running version 149.0.7827.114 and earlier are affected. Desktop Chrome and Chrome on other platforms are not impacted by this specific GPU use-after-free. Organizations should inventory Android devices with Chrome browsers, particularly those used for work or accessing sensitive systems.

Exploitability

Active exploitation requires two preconditions: (1) the renderer process must already be compromised (typically via a separate web-based exploit), and (2) the user must view a crafted HTML page while that compromised state exists. The CVSS vector indicates high complexity and required user interaction, which limits opportunistic attacks. However, in targeted scenarios where an attacker controls a malicious website or advertisement, the barrier to exploitation becomes lower. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update Google Chrome on Android to version 149.0.7827.115 or later. For enterprise deployments, apply updates through your mobile device management (MDM) solution to ensure policy-driven patching. Verify update status in Chrome settings (Menu > About Chrome > Chrome auto-updates). Organizations should prioritize this patch for devices handling sensitive workloads.

Patch guidance

Chrome on Android typically auto-updates, but verify completion by navigating to Chrome's settings menu and confirming the version number matches 149.0.7827.115 or higher. For managed environments, use MDM platforms (MobileIron, Microsoft Intune, etc.) to deploy and enforce the patch. Test in a staging environment first to ensure no compatibility issues with corporate apps or workflows. Set enforcement deadlines to ensure rapid coverage across your fleet.

Detection guidance

Monitor for crashes or unexpected behavior in Chrome's GPU process on Android (visible as persistent Chrome restarts or 'Chrome has stopped' messages). In enterprise environments, collect Chrome version telemetry via MDM solutions or endpoint detection and response (EDR) tools with Android support. Network-level detection is difficult because the attack relies on crafted HTML; focus on ensuring patch compliance and monitoring for anomalous GPU process behavior via available logging frameworks.

Why prioritize this

While this vulnerability requires a prior compromise, it significantly amplifies the damage of that compromise by enabling sandbox escape. High CVSS score (8.3) and broad scope change reflect the severity. Organizations with Android devices accessing sensitive systems should treat this as a critical patch due to the escalation risk, even though active exploitation is not currently documented in the wild.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects the combination of high confidentiality and integrity impact (the attacker can read and modify system data), high availability impact (potential for denial of service), and scope change from the browser to the system. The score is not higher because the attack requires high complexity (memory corruption must be triggered reliably) and user interaction (viewing a page). The lack of network-adjacent or physical requirements, and the ability to affect other users' data (scope change), justifies the substantial rating.

Frequently asked questions