Description
Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-14
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in the GPU component of Google Chrome on Android prior version 150.0.7871.125. It can allow a remote attacker who has already compromised the renderer process to escape the browser sandbox and execute code outside of the browser’s safety boundaries; this is inferred from the stated use‑after‑free and sandbox escape keywords. The weakness is identified as CWE‑416.

Affected Systems

Google Chrome on Android versions older than 150.0.7871.125 is affected; earlier builds remain vulnerable until an upgrade is performed.

Risk and Exploitability

The flaw carries a CVSS score of 8.3, indicating high severity, and its EPSS score is less than 1 % while it is not listed in CISA KEV, suggesting that exploitation is currently unlikely. The attack requires an attacker to first gain control of the renderer process and then serve a crafted HTML page to trigger the use‑after‑free, after which sandbox escape can occur. This attack path is inferred from the described conditions and is considered complex.

Generated by OpenCVE AI on July 31, 2026 at 04:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on Android to version 150.0.7871.125 or newer
  • Enable automatic updates on the device to receive future security patches promptly
  • If an upgrade is not immediately possible, disable GPU acceleration in the browser settings to reduce the attack surface

Generated by OpenCVE AI on July 31, 2026 at 04:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4687-1 chromium security update
Debian DSA Debian DSA DSA-6390-1 chromium security update
History

Wed, 29 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Use after free in GPU
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important

Sun, 26 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome GPU Permits Sandbox Escape on Android

Wed, 22 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome GPU Permits Sandbox Escape on Android

Mon, 20 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Title GPU Use‑After‑Free Leads to Sandbox Escape in Chrome on Android

Thu, 16 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title GPU Use‑After‑Free Leads to Sandbox Escape in Chrome on Android

Wed, 15 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 14 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-14T20:45:30.822Z

Reserved: 2026-07-14T18:31:16.575Z

Link: CVE-2026-15772

cve-icon Vulnrichment

Updated: 2026-07-14T20:45:28.029Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-14T20:09:53Z

Links: CVE-2026-15772 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T05:00:05Z

Weaknesses