Google Chrome for Android contains insufficient policy enforcement in its GPU implementation. A remote attacker who has already gained control of the renderer process can use a specially crafted HTML page to bypass the GPU sandbox and potentially escape to the host system. This enables compromise of the device, including execution of arbitrary code, data exfiltration, or other malicious actions on the affected device. The weakness corresponds to CWE‑266: Least Privilege Violation and CWE‑693: Control Flow Logic Error.

Android devices running Google Chrome versions prior to 148.0.7778.168 are vulnerable. The affected software is Chrome’s GPU subsystem, which is part of the browser’s rendering engine. The specific version range is all releases before the 148.0.7778.168 update announced in May 2026.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The described attack requires an attacker to first compromise the renderer process, which is non‑trivial but feasible if other browser weaknesses are exploited. The CVSS severity reported by Chromium is 8.3, indicating high risk. Given the lack of widespread public exploitation and high severity, the overall risk is considered moderate, but any compromise of the renderer process could lead to full device takeover.