CVE-2026-16424
A use‑after‑free bug in the GPU code of Google Chrome on Android allows a remote attacker who has already compromised the renderer process to escape the browser sandbox by loading a specially crafted HTML page. The flaw exists in Chrome versions before 150.0.7871.182.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Google Chrome for Android, versions earlier than 150.0.7871.182. Android users running those older Chrome builds are at risk.
Real-world impact
If exploited, an attacker could break out of the browser sandbox and execute arbitrary code on the device, potentially taking full control of the phone.
Why this severity
The CVSS score of 9.6 reflects that the attack can be launched over the network, requires no special privileges, needs only a user to open a crafted page, and would give the attacker complete confidentiality, integrity, and availability compromise.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/07/stable-channel-upda…release notesvendor advisory
- issues.chromium.org/issues/534858939permissions required