Chrome on Android GPU Vulnerability Allows Sandbox Escape

The National Vulnerability Database has detailed CVE-2026-6920, a critical out-of-bounds read vulnerability in Google Chrome’s GPU component on Android. This flaw, rated High severity (CVSS 7.5), allows a remote attacker who has already compromised the renderer process to escape the browser’s sandbox. Attackers can achieve this by tricking a user into visiting a specially crafted HTML page.

This vulnerability impacts users running Google Chrome on Android versions prior to 147.0.7727.117. The attacker’s calculus is straightforward: gain initial renderer compromise, then leverage this GPU flaw for deeper system access. For defenders, this highlights the ongoing battleground within browser components and the need for rapid patching.

Organizations should mandate immediate updates for all Android devices running Chrome. Reviewing browser configurations and considering enhanced endpoint detection and response (EDR) for mobile devices can provide additional layers of defense against such sophisticated browser-based attacks.