Description
Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An integer overflow occurs in the GPU subsystem of Google Chrome for Android that can be triggered by loading a specially crafted HTML page. The flaw allows a remote attacker to perform an out‑of‑bounds memory access, and the Chromium security team has rated it as a medium severity issue.

Affected Systems

Google Chrome for Android versions earlier than 149.0.7827.53 are affected. All newer Chrome releases and other Google Chrome products are not impacted.

Risk and Exploitability

The vulnerability can be exposed remotely through a web page, meaning any device with an Internet browser running the vulnerable Chrome version is at risk. The EPSS score is <1% and the vulnerability is not listed in CISA KEV. With a CVSS score of 8.8, the vulnerability is rated high severity, and the potential for out‑of‑bounds memory access further increases risk. Attackers would likely need to entice the victim to visit or load the malicious page, and further exploitation would depend on additional conditions that are not described in the CVE data.

Generated by OpenCVE AI on June 5, 2026 at 18:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.53 or later via the official update channel
  • Enforce Chrome updates across the organization using managed configuration or enterprise policy
  • Implement web filtering or security monitoring to block or detect malicious HTML content that could trigger the vulnerability

Generated by OpenCVE AI on June 5, 2026 at 18:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Integer overflow in GPU
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 05 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Title Google Chrome Android GPU Integer Overflow Leading to Out‑of‑Bounds Memory Access via Crafted Web Page

Fri, 05 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 05:30:00 +0000

Type Values Removed Values Added
Title Google Chrome Android GPU Integer Overflow Leading to Out‑of‑Bounds Memory Access via Crafted Web Page

Fri, 05 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-472
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T16:49:56.729Z

Reserved: 2026-06-04T17:06:46.658Z

Link: CVE-2026-11085

cve-icon Vulnrichment

Updated: 2026-06-05T14:18:29.731Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:13.333

Modified: 2026-06-08T14:35:11.803

Link: CVE-2026-11085

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11085 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T19:00:16Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

  • CWE-472

    External Control of Assumed-Immutable Web Parameter