CVE-2026-79241 in Chrome
Summary
by MITRE • 08/26/2026
Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an out-of-bounds read within the GPU subsystem of Google Chrome on Android represents a significant memory safety flaw that undermines the browser's core isolation mechanisms. This issue, present in versions prior to 152.0.7977.65, stems from improper boundary checks during graphics processing operations. When a user visits a maliciously crafted HTML page containing specific WebGL or GPU-accelerated content, the renderer process attempts to access memory locations that lie outside the allocated buffer boundaries. Because this operation occurs within the GPU utility process or related sandboxed environments, it allows for an information disclosure attack where sensitive data residing in adjacent memory regions can be read by the attacker. The Chromium security team has classified this vulnerability with a medium severity rating, reflecting its potential to leak internal browser state or potentially aid in further exploitation attempts against more critical components.
From a technical perspective, out-of-bounds reads are categorized under CWE-125, which describes situations where software reads memory past the end of a buffer. In the context of modern web browsers, such vulnerabilities are particularly dangerous because they can bypass sandbox protections if the leaked information includes pointers to other processes or sensitive cryptographic keys stored in memory. The attack vector relies on social engineering or drive-by download tactics, requiring only that an unsuspecting user navigates to a malicious website. Once triggered, the crafted HTML page exploits the flaw in the GPU handling logic, causing the browser to return data from unauthorized memory locations back to the JavaScript context running within the webpage. This leakage can reveal internal structures of the Chromium engine or other application-specific secrets loaded into the same process space.
The operational impact of this vulnerability is primarily centered on information disclosure and potential sandbox escape facilitation. While an out-of-bounds read does not directly allow arbitrary code execution, it provides attackers with valuable intelligence about the target environment. This data can be used to construct more sophisticated exploits that leverage additional vulnerabilities in the browser or operating system. For mobile users running Android, the risk is compounded by the shared nature of memory resources and the potential for cross-site scripting attacks to persist across sessions if session cookies or tokens are inadvertently leaked through this side-channel. The ATT&CK framework maps this behavior to T1005, which covers Data from Local System Retrieval, specifically indicating how an adversary might gather sensitive information without direct file system access by exploiting memory corruption flaws in running applications.
Mitigation for this vulnerability requires immediate updates to the Google Chrome browser on Android devices to version 152.0.7977.65 or later. Users should ensure that automatic updates are enabled to receive security patches promptly as they become available. For enterprise environments, administrators must enforce update policies across all managed Android devices to prevent exposure to such web-based attacks. Additionally, defense-in-depth strategies such as enabling Site Isolation and ensuring hardware acceleration settings do not bypass critical sandbox boundaries can reduce the attack surface. Security awareness training for end-users remains essential to minimize the risk of visiting maliciously crafted websites that attempt to exploit these types of memory corruption vulnerabilities in browser rendering engines.