Description

Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:17:56.537Z",
  "pubdate": "2026-08-25T21:17:56.537Z",
  "executiveSummary": "A critical security vulnerability involving improper input validation exists within the GPU process of Google Chrome on Android versions prior to 152.0.7977.65.\nThe flaw allows a remote attacker who has already successfully compromised the renderer process to perform a sandbox escape, leading to arbitrary code execution on the underlying device.\nThis vulnerability is classified with a Medium severity rating by Chromium, reflecting the requirement for an initial exploit chain or successful render process compromise prior to triggering the GPU-side flaw.\nThe risk implication is significant, as it grants attackers the capability to bypass browser sandbox protections, potentially accessing system resources or user data that the browser process is restricted from interacting with directly.\nExploitation requires the victim to render a specifically crafted HTML page, which facilitates the weaponization of the underlying input validation failure within the GPU subsystem.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the GPU process of the Chromium engine. In the multi-process architecture of Google Chrome, the renderer process is sandboxed to isolate untrusted web content from the underlying operating system. The GPU process, responsible for hardware-accelerated rendering, typically operates with higher privileges than the renderer to facilitate direct communication with graphics drivers.\nThe vulnerability manifests when the GPU process fails to adequately sanitize or validate data inputs originating from a compromised renderer process. When an attacker successfully compromises the renderer process—for instance, through a separate memory corruption vulnerability in the JavaScript engine or DOM implementation—they gain the ability to send inter-process communication (IPC) messages to the GPU process.\nThe attack flow follows a structured trajectory: First, an attacker lures a target to a malicious website containing a crafted HTML payload. Second, the renderer process parses this content, triggering the initial exploit to gain code execution within that sandbox. Third, the attacker leverages the established foothold to send malformed IPC messages or inputs to the GPU process. Because the GPU process lacks rigorous validation of these incoming structures, it may process tainted data in a way that leads to a memory corruption event, such as a buffer overflow or an out-of-bounds write.\nBy manipulating the memory state of the GPU process, the attacker can hijack the control flow of the process. Since the GPU process is less constrained by the renderer's sandbox, successfully redirecting execution allows the attacker to execute arbitrary machine code with the privileges of the GPU process itself. This effectively results in a sandbox escape. Once outside the sandbox, the attacker can leverage the compromised process to interact with system APIs, potentially leading to unauthorized data exfiltration, persistent malware installation, or further escalation of privilege depending on the Android device's kernel security posture.\nThis vulnerability affects Google Chrome on Android versions prior to 152.0.7977.65. The flaw emphasizes the critical need for strict interface definition and rigorous input sanitization at the boundaries between isolated browser processes, particularly when those processes bridge the gap between restricted web content and privileged system-level hardware interfaces."
}