An improper boundary check in the GPU component of Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape the sandbox. The vulnerability can compromise a device’s security context, potentially exposing privileged resources or enabling further attacks. The weakness is an example of input validation errors (CWE‑20) and insufficient untrusted input into paths (CWE‑653).

Google Chrome for Android versions earlier than 149.0.7827.53 are affected. Devices running these releases should be considered at risk until an official patch is applied.

The CVE has a critical high CVSS score of 9.6. The EPSS score is less than 1%, and it is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. The attack requires that the attacker already execute code in the renderer process, which typically occurs after a user visits a malicious web page or views a compromised media resource. If the renderer is breached, the GPU path may be used to escape the sandbox.