External risk intelligence

Google Chrome for Android GPU Integer Overflow leads to Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87643

This vulnerability exists within a web browser, which is a client-side application designed to render untrusted content from the public internet. Because users frequently navigate to arbitrary web pages, the attack surface is exposed to the internet by design during normal browser usage.

Integer Overflow

Google Chrome

before 153.0.8010.36

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An integer overflow in Google Chrome on Android could allow an attacker to execute code outside the sandbox by luring a user to a malicious webpage. While this vulnerability has a critical severity rating, the primary concern for leadership is to confirm its relevance and exposure within the organization.

Code execution flaw in Android Chrome.
Potential for significant unauthorized system access.
Confirm relevance and any potential exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker can entice a user to visit a malicious HTML page. This page exploits an integer overflow vulnerability in Chrome's GPU component on Android, potentially allowing code execution beyond the browser's security boundaries.

Entry: Malicious HTML page.
Trigger: User visits the page.
Risk: Code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to execute arbitrary code outside the Chrome sandbox. This could occur when a user visits a crafted HTML page, potentially impacting the device's integrity and confidentiality.

Device integrity and confidentiality at risk.
Visiting a malicious HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Chrome browser on Android, suggesting that the application owners and the platform team responsible for managing Android devices are primary stakeholders. The immediate next step is to locate all instances of the affected browser, assess their reachability, and determine business criticality to prioritize remediation efforts.

Application owners and platform teams should lead.
Verify browser reachability and business criticality.
Coordinate vendor updates and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for Android and its GPU component?

Google Chrome for Android is a web browser used for navigating the internet on mobile devices. The GPU component is a specialized subsystem responsible for rendering graphics and visual content efficiently. It handles complex calculations to display webpages, media, and animations by offloading processing tasks from the main system processor.

What does an integer overflow vulnerability mean in CVE-2026-87643?

An integer overflow occurs when software attempts to store a number too large for the allocated memory space, causing the value to wrap around to an unexpected smaller number. In this CVE, this logic error in the GPU component can confuse the browser's memory management, which attackers may leverage to bypass security restrictions and run unauthorized code.

How is this Chrome GPU flaw triggered?

The vulnerability is triggered when a user navigates to a specifically crafted HTML page designed to exploit the integer overflow. Simply having the browser installed is not enough to trigger the bug; the browser must actively process the malicious content. Normal, benign websites do not initiate this condition.

Is my device at risk based on Halo Surface Signal?

Yes, Halo Surface Signal identifies this as a likely risk because Chrome is a client-side application designed to render untrusted content from the public internet. Since users frequently navigate to arbitrary websites, the attack surface is exposed to the internet by design, making any device running an unpatched version of this browser susceptible.

What should I do first to address CVE-2026-87643?

Your first step is to identify all Android devices within your environment running an affected version of Google Chrome. Once identified, coordinate with the teams managing these mobile assets to prioritize and deploy the latest official vendor updates. Ensuring the browser software is updated to the version specified by the manufacturer is the primary defense.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.