CVE-2026-10892
A flaw in Google Chrome for Android lets a remote attacker escape the browser sandbox by loading a specially crafted web page. The vulnerability is caused by an out‑of‑bounds write in the GPU code. It could allow attackers to run arbitrary code on the device.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome on Android, versions earlier than 149.0.7827.53.
Real-world impact
An attacker could run arbitrary code on the victim’s Android device by tricking them into opening a malicious web page, potentially taking full control of the device.
Why this severity
The CVSS score of 9.6 reflects that the flaw can be exploited remotely with no user interaction beyond visiting a malicious page, and it allows complete compromise of confidentiality, integrity, and availability.
What to do about it
- 011. Update Google Chrome to version 149.0.7827.53 or later on your Android device.
- 022. Restart the browser to ensure the update takes effect.
NVD description indicates that versions prior to 149.0.7827.53 are vulnerable; upgrading to 149.0.7827.53 or later resolves the issue.
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/513165325permissions required