CVE-2026-12030: Chrome Android GPU Out-of-Bounds Write Sandbox Escape

Technical summary

CVE-2026-12030 is an out-of-bounds write vulnerability (CWE-122) in Chrome's GPU subsystem affecting Android versions prior to 149.0.7827.115. The flaw exists in memory handling within the GPU component and can be triggered via a crafted HTML page. The vulnerability requires a two-stage attack: first, the renderer process must be compromised through a separate attack vector; second, the attacker exploits this out-of-bounds write to break out of the renderer sandbox and gain execution in the broader Android context. The CVSS 3.1 score of 8.3 reflects high impact (confidentiality, integrity, and availability all marked as high) and the requirement for user interaction and high attack complexity.

Business impact

If exploited in a targeted attack chain, this vulnerability could allow an attacker to gain unauthorized access to sensitive user data, install malware, or achieve persistent device control on Android systems running vulnerable Chrome versions. For organizations with BYOD policies or enterprise-managed Android devices, this represents a path to lateral movement into corporate networks. The sandbox escape capability is particularly concerning because it negates Chrome's primary defense mechanism, making successful exploitation result in near-device-level compromise.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.115 are affected. The vulnerability is specific to the Android platform; other Chrome implementations on desktop or iOS are not impacted by this GPU rendering flaw. Users running Chrome 149.0.7827.115 or later on Android are protected.

Exploitability

Exploitation requires two preconditions: (1) initial compromise of the Chrome renderer process through a separate vulnerability or social engineering attack, and (2) user interaction to visit a malicious webpage. In the wild, this would likely be chained with a renderer exploit or used as a second-stage payload after initial browser compromise. The high attack complexity reflects these requirements. No evidence of active exploitation has been reported as of the CVE publication date, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Immediate patching is the primary mitigation. Users should update Google Chrome on Android to version 149.0.7827.115 or later as soon as possible. Organizations managing Android devices should enforce automatic Chrome updates or deploy this version through their mobile device management platform. For systems that cannot be updated immediately, restrict user browsing to trusted internal sites and disable extension installation to reduce attack surface.

Patch guidance

Apply Chrome version 149.0.7827.115 or later on all Android devices. Verify the Chrome version under Settings > About Chrome; most devices with automatic updates enabled should receive this update within days of release. Organizations using managed Chrome deployments should test the patch in a staging environment before broad rollout, though the urgency of a sandbox escape typically justifies rapid deployment. Check the official Google Chrome release notes and security advisory for any platform-specific considerations.

Detection guidance

Monitor Chrome crash reports and system logs for GPU-related process terminations, which may indicate exploitation attempts. Endpoint detection and response (EDR) tools on Android should flag suspicious child process creation or unusual permission escalation following Chrome execution. Browser telemetry from Chrome itself reports crashes to Google; review these reports for patterns suggesting targeted exploitation. Network-level detection is limited since exploitation occurs post-compromise and involves no additional outbound connections beyond the initial malicious page fetch.

Why prioritize this

This vulnerability merits high priority because it enables sandbox escape—the ultimate goal of a compromised browser. While it requires a two-stage attack, the combination of a remote trigger (crafted HTML) and high impact (full sandbox bypass) makes it a logical target for advanced adversaries. Its presence in high-risk environments (BYOD, user-facing systems) and the simplicity of the trigger (visiting a webpage) after initial compromise elevate risk even though it is not yet actively exploited. Patching should precede general Chrome maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: network-based attack vector, high attack complexity (requiring prior compromise and user interaction), no privileges required, user interaction required, changed scope (escape from renderer sandbox to system level), and high impact across confidentiality, integrity, and availability. This score appropriately captures the severity of a sandbox escape; while not critical, it represents a significant escalation from renderer compromise to device compromise.

Frequently asked questions