Description

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-07-21T23:17:00.030Z",
  "pubdate": "2026-07-21T23:17:00.030Z",
  "executiveSummary": "A use-after-free vulnerability exists within the GPU component of Google Chrome on Android prior to version 150.0.7871.182. This security flaw carries a Chromium security severity rating of High and presents severe risk implications for affected mobile devices.\nThe vulnerability allows a remote attacker who has already successfully compromised the renderer process to potentially execute a sandbox escape by leveraging a crafted HTML page. Exploitation requires the attacker to interact with the target via untrusted web content capable of achieving preliminary code execution within the restricted renderer sandbox.\nSuccessful exploitation compromises the isolation boundaries enforced by the browser architecture, potentially enabling malicious actors to escalate privileges from the confined renderer process to broader system contexts through the compromised GPU process.",
  "technicalDetails": "The root cause of the vulnerability is a use-after-free memory management defect residing in the GPU component of Google Chrome on Android. A use-after-free condition occurs when memory is dynamically allocated, subsequently freed, but a pointer to that memory address is retained and dereferenced later during program execution. This can lead to unpredictable application behavior, memory corruption, and arbitrary code execution capabilities if the freed heap memory is reallocated and manipulated by an attacker.\nThe affected product is Google Chrome on Android, specifically targeting versions prior to 150.0.7871.182. The vulnerable component is the GPU subsystem responsible for hardware-accelerated graphics rendering and processing.\nThe attack vector requires a remote attacker to deliver a crafted HTML page to a target user running an unpatched version of the browser. The attack flow assumes the attacker has already compromised the renderer process, likely via a prior vulnerability or initial remote code execution vector within the web content context.\nOperating from the compromised renderer process, the attacker interacts with the GPU component through the crafted HTML page and associated scripts. By triggering the use-after-free condition within the GPU subsystem, the attacker attempts to manipulate memory layouts and corrupt heap structures.\nBecause the GPU process typically operates with higher privileges than the locked-down renderer sandbox, successfully exploiting this memory corruption vulnerability enables the attacker to achieve a sandbox escape. This post-exploitation impact undermines the multi-process architecture security model of the browser, potentially allowing further system compromise on the underlying Android device."
}