CVE-2026-79008

Published Aug 25, 2026 CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Description

Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical impact

This vulnerability arises from improper input validation in the GPU component of Google Chrome on Android, allowing a remote attacker who has already gained control of the renderer process to execute arbitrary code outside the sandbox. The flaw is identified as CWE-20 and can lead to full system compromise.

Affected Systems

Affected devices run Google Chrome on Android prior to version 152.0.7977.65. Any device with this build, including older Android releases, is susceptible unless updated.

Risk and Exploitability

The CVE is rated 8.3 on the CVSS scale, indicating high severity, and the EPSS score is below 1%, suggesting a low likelihood of immediate exploitation. It is not listed in the CISA KEV catalog. The flaw allows an attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code, exposing the entire device. Although no public exploits have been documented, the remote nature and high CVSS score warrant prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`152.0.7977.65`	affected	< 152.0.7977.65

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[152.0.7977.65,152.0.7977.65)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Chrome to version 152.0.7977.65 or later
If updating immediately is not possible, disable GPU acceleration or the GPU process in Chrome settings to reduce the attack surface
Regularly monitor Google Chrome security advisories and apply any future patches or workarounds promptly

Generated by OpenCVE AI on August 26, 2026 at 17:22 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4771-1	chromium security update
Debian DSA	DSA-6482-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.432% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
https://issues.chromium.org/issues/517382613

History

Aug 26, 2026 7:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google android
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:google:android:-:::::::*
Vendors & Products		Google android

Aug 26, 2026 5:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Remote Code Execution via GPU Input Validation Vulnerability in Chrome on Android

Aug 26, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Aug 25, 2026 11:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Remote Code Execution via GPU Input Validation Vulnerability in Chrome on Android

Aug 25, 2026 8:30 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses		CWE-20
References		https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html https://issues.chromium.org/issues/517382613