CVE-2026-9872
A critical flaw in Google Chrome on Android lets a remote attacker escape the browser sandbox by loading a specially crafted web page. The vulnerability is an out‑of‑bounds write in the GPU code, which could allow arbitrary code execution on the device. Updating Chrome to the latest version removes the risk.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome on Android versions earlier than 148.0.7778.216.
Real-world impact
An attacker could run arbitrary code on a victim’s Android device by tricking them into opening a malicious web page, potentially taking full control of the device.
Why this severity
The CVSS score of 9.6 reflects the lack of authentication required, the high impact of a sandbox escape, and the ability for an attacker to execute code with full system privileges. The vector shows that the attack is network‑based, low effort, and requires user interaction to load the crafted page.
What to do about it
- 01Update Google Chrome to version 148.0.7778.216 or later.
- 02Restart the browser to apply the update.
NVD description indicates that versions prior to 148.0.7778.216 are vulnerable; updating to that version or later resolves the issue.
Timeline
- May 28, 2026 · May 28, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/05/stable-channel-upda…release notes
- issues.chromium.org/issues/505077859permissions required