Use After Free in GPU in Google Chrome on Android

Executive Summary

CVE-2026-15772 is a use-after-free vulnerability in the GPU component of Google Chrome on Android. This flaw occurs when a program continues to use memory after it has been freed, which can lead to unexpected behavior or crashes.

In this case, a remote attacker who has already compromised the renderer process of Chrome could exploit this vulnerability by crafting a malicious HTML page. Successful exploitation could allow the attacker to escape the sandbox, which is a security mechanism designed to isolate running programs and limit their access to the system.

The Chromium security team has rated this vulnerability as High severity.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability on your network or system requires checking the version of Google Chrome on Android devices. The vulnerability affects Google Chrome on Android prior to version 150.0.7871.125.

• Check the installed version of Google Chrome on Android devices. You can do this manually by opening Chrome, navigating to Settings > About Chrome, and noting the version number.
• For automated detection, use mobile device management (MDM) tools or scripts to query the installed Chrome version on managed Android devices. Example commands or scripts depend on the MDM solution in use, but generally involve querying the package version for 'com.android.chrome'.

If the version is below 150.0.7871.125, the device is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of Google Chrome on Android (prior to 150.0.7871.125), this vulnerability could impact you in the following ways:

• A remote attacker could exploit this flaw to escape the Chrome sandbox, potentially gaining elevated privileges on your device.
• Once the sandbox is escaped, the attacker may be able to access sensitive data, install malware, or perform other malicious actions on your device.
• The attacker would need to trick you into visiting a specially crafted malicious webpage to exploit this vulnerability.

The high CVSS base score of 8.3 indicates that this is a serious vulnerability with significant potential for harm.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If an attacker exploits this vulnerability to access or exfiltrate personal data of EU citizens, it could lead to a data breach. Under GDPR, organizations must implement appropriate security measures to protect personal data. Failure to patch this vulnerability or mitigate its risks could be seen as a violation of GDPR's security requirements, potentially resulting in fines or penalties.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI) in the U.S., this vulnerability could lead to unauthorized access to PHI if exploited. HIPAA requires covered entities to implement safeguards to protect PHI. Failure to address this vulnerability could result in non-compliance and potential penalties.
• Other standards (e.g., ISO 27001, NIST): Many security frameworks require organizations to maintain up-to-date software and apply security patches promptly. This vulnerability, if left unpatched, could indicate a failure to meet such requirements, potentially affecting certification or compliance status.

To maintain compliance, organizations should ensure that affected versions of Google Chrome on Android are updated to the patched version (150.0.7871.125 or later) as soon as possible.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Update Google Chrome on all Android devices to version 150.0.7871.125 or later. This can be done via the Google Play Store by searching for Chrome and selecting 'Update' if available.
• If an update is not immediately available, consider restricting the use of Chrome on Android devices until the update can be applied.
• Educate users about the risks of visiting untrusted websites or clicking on suspicious links, as the vulnerability can be exploited via a crafted HTML page.
• Monitor for any unusual activity or signs of compromise on devices, especially those that may have accessed untrusted content.

Useful 0 Not Useful 0