CVE Intelligence
Analysis AI-assisted

CVE-2026-9872: Google Chrome for Android GPU out-of-bounds write

CVE-2026-9872 is an out-of-bounds write in the GPU component of Google Chrome on Android, classified as CWE-787. The record states that a remote attacker could potentially escape the sandbox using a crafted HTML page, and the reported CVSS base score is 9.6. CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9872 is an out-of-bounds write in the GPU component of Google Chrome on Android. According to the record, a remote attacker could potentially use a crafted HTML page to attempt a sandbox escape. The Chromium project rates the issue as Critical.

Impact

  • The description refers to a potential sandbox escape, meaning code could in principle move beyond the browser's sandbox boundary.
  • The CVSS base score of 9.6 is reported by the CNA and by CISA-ADP. The vector indicates network access, low complexity, no privileges, required user interaction, changed scope and high impact on confidentiality, integrity and availability.
  • Because user interaction is required, a victim would need to load the crafted page for the issue to be reachable.

Affected products and versions

  • Google Chrome on Android, before 148.0.7778.216.
  • The record contains a second, redundant range that overlaps the first. It should be checked against the vendor release notes before drawing conclusions about boundaries.

Exploitation status

CISA KEV does not list this CVE. The SSVC exploitation value is recorded as none, and the SSVC automatable value is no. No confirmed exploitation appears in the sources consulted, so this analysis does not state that the issue is being exploited in the wild.

Remediation and mitigation

  • Update Google Chrome on Android to 148.0.7778.216 or later, which is the build at which the description stops listing the product as affected.
  • Where updates cannot be applied immediately, limit browsing of untrusted web content on affected devices and rely on mobile device management policies to enforce updates.
  • Follow the vendor release notes linked below for the complete list of fixes in the same release.

Detection guidance

  • Inventory Android devices running Chrome and record their installed build, so that devices below 148.0.7778.216 can be identified.
  • Use mobile device management or endpoint tooling to report browser versions and confirm update compliance.
  • Review reports of unexpected browser crashes or GPU-related instability on managed devices as a general signal to investigate, without treating them as proof of compromise.

Limitations of the available information

  • The record does not list fixed versions in its structured fields, so the fixed build is taken from the description wording and should be confirmed against vendor notes.
  • The affected range in the record is redundant and partially contradictory.
  • No technical details, public proof of concept or exploit availability are included in the sources consulted.
  • The EPSS values are a probability snapshot and do not indicate confirmed exploitation.
  • The record has no title, so the title in this analysis was written from the description.

Frequently asked questions

Is CVE-2026-9872 being exploited in the wild?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is recorded as none.

Which Chrome version fixes this issue on Android?

The description says Chrome on Android is affected before 148.0.7778.216, so that build is the first one the description does not list as affected. Confirm this against the vendor release notes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.