Out of bounds read in the GPU component of Google Chrome on Android, versions prior to 147.0.7727.117, enables a remote attacker who has already compromised the renderer process to craft an HTML page that induces a sandbox escape. This flaw is a CWE-125 buffer under-read, which can expose memory contents outside the expected bounds and after exploitation may allow execution of arbitrary code outside the renderer’s sandbox, compromising confidentiality, integrity, and availability of the device.

Affected systems are Google Chrome browsers on Android devices running any version earlier than 147.0.7727.117. The vulnerability is tied specifically to the GPU acceleration path utilized by the renderer process on Android; no other operating systems or Chrome on desktop are mentioned in the description. Administrators should verify the version of Chrome installed on all Android devices and ensure it is updated to 147.0.7727.117 or later.

The CVSS score is 9.6, indicating a high severity vulnerability, but the EPSS score is below 1%, suggesting a low probability of exploitation at present. The risk is elevated because sandbox escape can lead to arbitrary code execution. The attack vector appears to be remote via a crafted HTML page that is processed by the renderer; an attacker must first compromise the renderer process, which may be achieved through other vulnerabilities or social engineering. Although the vulnerability is not listed in CISA’s KEV catalog, organizations should prioritize patching as the only definitive fix.