Description

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-29T18:17:28.760Z",
  "pubdate": "2026-09-29T18:17:28.760Z",
  "executiveSummary": "A critical out-of-bounds write vulnerability exists within the GPU process of Google Chrome on Android. This vulnerability, stemming from improper memory handling, allows a remote attacker to achieve arbitrary code execution beyond the confines of the browser sandbox. By leveraging a specially crafted HTML page, an attacker can trigger memory corruption within the GPU subsystem. The impact of this flaw is severe, potentially leading to full compromise of the browser's security model, including unauthorized access to sensitive user data and arbitrary code execution on the underlying device. As the vulnerability resides in the GPU process, exploitation bypasses standard browser-level sandbox protections. The issue affects all versions of Google Chrome on Android prior to 154.0.8037.57. No user interaction beyond navigating to a malicious webpage is strictly required, although the attacker must successfully entice the victim to visit the crafted site. Given the criticality and the nature of sandbox escape vulnerabilities, immediate patching is essential to prevent potential exploitation.",
  "technicalDetails": "The vulnerability is an out-of-bounds (OOB) write flaw located within the GPU process of the Chromium engine. This occurs when the GPU component fails to properly validate the bounds of data during memory write operations, leading to an overwrite of adjacent memory locations. In the context of browser security, the GPU process often handles complex rendering tasks and shader compilations, making it a high-value target for exploitation.\nThe attack flow begins when a user visits a malicious website containing a crafted HTML page. The page contains malicious JavaScript or specific WebGL/WebGPU calls designed to trigger the vulnerable code path in the GPU process. When the GPU process attempts to process these inputs, the lack of boundary verification causes the application to write data outside of its allocated buffer.\nBy carefully grooming the heap memory, an attacker can control the data that is overwritten. This typically involves placing specific objects in memory prior to triggering the out-of-bounds write. Successful exploitation allows the attacker to corrupt function pointers or other critical control flow structures within the GPU process memory space. By redirecting the instruction pointer to attacker-controlled shellcode or executing a return-oriented programming (ROP) chain, the attacker gains the ability to execute arbitrary code.\nBecause the GPU process operates with elevated privileges compared to the standard renderer sandbox, achieving arbitrary code execution here represents a significant security breach. It effectively allows the attacker to break out of the Chromium sandbox, granting them the ability to interact with the system or access resources that would otherwise be restricted. The vulnerability is triggered remotely and does not require local authentication or specialized privileges on the target device, relying entirely on the victim's interaction with the malicious content.\nThe affected versions include all Google Chrome on Android releases prior to 154.0.8037.57. The primary component responsible for the failure is the memory management logic within the GPU process pipeline. The exploit is highly dangerous because it facilitates sandbox escape, thereby circumventing the primary security architecture designed to isolate browser processes from the operating system."
}