CVE-2026-9912: Chrome GPU Memory Disclosure on Android – Patch Required

Technical summary

CVE-2026-9912 is a memory disclosure vulnerability in Chrome's GPU implementation on Android. The vulnerability stems from an inappropriate implementation in GPU-related code that fails to properly isolate or protect process memory regions. An unauthenticated remote attacker can exploit this by hosting a crafted HTML page. When a user navigates to the malicious page, the GPU processing logic incorrectly exposes memory contents that should remain private to the Chrome process. The vulnerability affects Chrome on Android versions prior to 148.0.7778.216. Chromium has classified this as a High-severity issue internally, though the CVSS 3.1 score of 6.5 reflects the requirement for user interaction (visiting a page).

Business impact

This vulnerability poses a data confidentiality risk to Chrome users on Android. Sensitive information accessible from process memory—such as session tokens, cached credentials, encryption keys, or user data from other browser tabs—could be extracted and used for account takeover, session hijacking, or further attacks. For organizations managing Android devices with corporate users, compromise of Chrome's process memory could lead to unauthorized access to internal systems or cloud services. The limited attack surface (requires user to visit a crafted page) moderates the enterprise risk, but the high information sensitivity makes this noteworthy for security teams managing mobile devices.

Affected systems

Google Chrome on Android versions prior to 148.0.7778.216 are affected. Desktop versions of Chrome and Chrome on other platforms are not impacted by this specific GPU implementation flaw. Android devices running older Chrome versions present the highest risk, particularly those where auto-update may be disabled or delayed.

Exploitability

Exploitability is straightforward from an attacker's perspective but requires user interaction. An attacker must trick or socially engineer a user into visiting a malicious web page; they cannot exploit the vulnerability through passive network attacks or without user action. However, the craft threshold is low—the malicious HTML does not require JavaScript exploitation or plugin vulnerabilities, just carefully constructed GPU rendering commands. Given Chrome's widespread use on Android and the ease of distributing malicious links via social engineering, practical exploitability is considered moderate to high. The vulnerability is not known to be actively exploited in the wild (KEV status is false), which provides a window for patching before widespread attack campaigns.

Remediation

Update Chrome on Android to version 148.0.7778.216 or later. Users should enable automatic updates in the Google Play Store settings to receive patches immediately. For managed Android deployments, IT teams should verify that Chrome auto-update policies are enforced and push updates through their mobile device management (MDM) solution if available. Interim risk reduction can be achieved by educating users to avoid clicking untrusted links and restricting browsing to known safe sites, though patching remains the only complete mitigation.

Patch guidance

Google has released Chrome version 148.0.7778.216 and later containing the fix. Verify the installed version by navigating to Chrome's About page (Settings > About Chrome). The Play Store will automatically deliver updates if auto-update is enabled; users and administrators should confirm this setting is active. For organizations using Chromebook or Android Enterprise, verify that Chrome updates are pushed through your MDM console. No manual configuration changes or workarounds are needed post-patch; the update simply requires installation and a browser restart.

Detection guidance

Detection is challenging at the endpoint level because the exploitation occurs within Chrome's GPU processing pipeline and leaves minimal forensic artifacts. Monitor for: (1) unusual outbound network connections from Chrome to unfamiliar domains, particularly if correlated with employee reports of unexpected behavior; (2) Chrome process crashes or restarts, which may occur if exploitation fails or triggers error handling; (3) access logs to your organization's authentication systems for anomalous session activity that correlates with the date range when Chrome versions prior to 148.0.7778.216 were in use. On the network side, intrusion detection systems with visibility into DNS queries and TLS handshakes may flag suspicious domains used in phishing campaigns that distribute the malicious HTML. The most reliable detection is proactive: ensure all Android devices are running Chrome 148.0.7778.216 or later via MDM telemetry or vulnerability scanning tools.

Why prioritize this

Prioritize this patch for medium-to-high urgency. While the CVSS score is 6.5 (medium), the combination of high information sensitivity, ease of exploitation via social engineering, and widespread Chrome usage on Android argues for expedited remediation. Organizations with a large Android user base or high-value targets (executive devices, contractors accessing sensitive systems) should prioritize fastest. However, the lack of known active exploitation and the requirement for user interaction mean this does not warrant an emergency response; plan deployment within 2–4 weeks through your standard MDM update cycle.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) Network attack vector (AV:N)—attacker can exploit remotely; (2) Low attack complexity (AC:L)—no special conditions needed; (3) No privileges required (PR:N); (4) User interaction required (UI:R)—user must visit the malicious page; (5) Unchanged scope (S:U); (6) High confidentiality impact (C:H)—sensitive data can be extracted; (7) No integrity or availability impact (I:N, A:N). The medium severity reflects the user interaction requirement; without it, this would likely score in the 'High' or 'Critical' range given the memory disclosure risk.

Frequently asked questions