External risk intelligence

Google Chrome Android Out of Bounds Write Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-9872

This vulnerability affects a client-side web browser application. While it can be triggered by a user visiting a malicious website, the vulnerability itself exists within the end-user software on a local device, not as a public-facing service, appliance, or network gateway that is directly reachable or exposed by design on the internet.

Out-of-bounds Write

Google Chrome

before 148.0.7778.216

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An out-of-bounds write vulnerability has been identified in the GPU component of Google Chrome on Android. This could allow a remote attacker to potentially escape the browser's sandbox environment by directing a user to a malicious web page. The severity of this vulnerability has been classified as Critical.

Browser vulnerability impacts Android users visiting web pages.
Critical severity issue could affect user data and system integrity.
Confirm relevance and exposure within your Android Chrome usage.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious website that exploits a flaw in Chrome's GPU processing on Android. This could allow the attacker to break out of the browser's security sandbox, potentially leading to further compromise of the device.

Requires user interaction with a malicious website.
Triggered by out-of-bounds write in GPU.
Risk of sandbox escape on the device.

Live Threat

Current exploitation, exposure, and threat context

A sandbox escape could allow an attacker to affect sensitive information or system behavior on an Android device when a user visits a malicious website. This is possible due to an out-of-bounds write vulnerability in the GPU component of Google Chrome.

User data and system integrity at risk.
Remote attacker via crafted HTML page.
Potential sandbox escape on the device.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Chrome on Android requires a coordinated response. Application owners are responsible for identifying all instances of the affected browser, while infrastructure and platform teams should prioritize confirming its presence on business-critical devices. Network and security teams will need to monitor for exploitation attempts, and vendor management should engage with Google for timely updates. The first practical step is to inventory all Android devices running Chrome, assess their exposure, and then plan remediation based on the identified risk.

Identify application and device owners.
Verify Chrome browser reachability and criticality.
Plan targeted updates or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome on Android?

Google Chrome on Android is the mobile version of the widely used web browser, designed to render web pages and execute JavaScript on Android-based smartphones and tablets. It uses a graphics processing unit (GPU) component to accelerate the rendering of complex visual elements and animations, which helps improve overall performance and page responsiveness during daily browsing activities.

What is an out-of-bounds write in CVE-2026-9872?

An out-of-bounds write is a weakness, classified as CWE-787, where software writes data outside the expected boundaries of a memory buffer. In the context of this CVE, the browser's GPU component incorrectly handles data, which could allow an attacker to overwrite adjacent memory. This unintended access is significant because it can lead to a sandbox escape, where malicious code breaks out of the browser's restricted environment to affect the underlying device.

How is this vulnerability triggered?

This flaw is triggered when a user visits a specially crafted, malicious HTML page that leverages the GPU processing error. The vulnerability does not trigger through background network activity, standard app usage, or typical browser operations; it requires specific, active interaction where a user is enticed to navigate to a site designed to exploit the GPU memory handling.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that this is unlikely to pose a traditional network-based risk. Because the vulnerability exists within the local browser application on a mobile device rather than an internet-facing server or appliance, it is not directly reachable by attackers scanning the network. Your risk is primarily dependent on user behavior and the specific sites visited rather than the device's network presence.

How do I protect against CVE-2026-9872?

The most effective way to address this issue is to ensure your version of Chrome is up to date. Check your Android device settings or the Google Play Store to confirm that your browser version is 148.0.7778.216 or higher. If an update is available, install it immediately to patch the GPU component and close the memory write flaw, effectively neutralizing the path for a potential sandbox escape.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.