CVE-2026-6920: Google Chrome GPU Sandbox Escape RCE Flaw

CVE-2026-6920 Overview

CVE-2026-6920 is an out-of-bounds read vulnerability in the GPU component of Google Chrome on Android. This critical security flaw exists in versions prior to 147.0.7727.117 and allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The vulnerability was classified with a Chromium security severity of High.

Critical Impact

An attacker exploiting this vulnerability can escape the Chrome sandbox after compromising the renderer process, potentially gaining elevated privileges on the device. This represents a significant security risk as sandbox escapes undermine the browser's primary defense mechanism against malicious code execution.

Affected Products

• Google Chrome on Android prior to version 147.0.7727.117
• Chromium-based browsers using affected GPU code

Discovery Timeline

• April 23, 2026 - CVE-2026-6920 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6920

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption flaw in Chrome's GPU process handling. The out-of-bounds read condition occurs when processing GPU commands, where insufficient boundary validation allows reading memory beyond the intended buffer limits.

The attack requires an initial compromise of the renderer process, which is typically achieved through a separate vulnerability. Once the renderer is compromised, the attacker can craft malicious GPU commands that trigger the out-of-bounds read in the GPU process. Since the GPU process operates with higher privileges than the sandboxed renderer, successfully exploiting this vulnerability enables sandbox escape.

The network-based attack vector combined with the sandbox escape capability makes this a particularly dangerous vulnerability, as it can be triggered simply by visiting a malicious webpage containing crafted HTML content.

Root Cause

The root cause is improper bounds checking in the GPU component when processing certain operations. The code fails to adequately validate buffer boundaries before reading data, allowing access to memory locations outside the allocated buffer. This type of flaw in security-critical code paths can expose sensitive information or enable further exploitation when combined with other vulnerabilities.

Attack Vector

The attack is network-based and requires user interaction—specifically, the victim must navigate to an attacker-controlled webpage. The attack proceeds in multiple stages:

1. The attacker crafts a malicious HTML page designed to first compromise the Chrome renderer process
2. Once renderer compromise is achieved, the attacker triggers the out-of-bounds read in the GPU process through crafted GPU commands
3. The memory disclosure or corruption from the OOB read facilitates sandbox escape
4. With sandbox escape achieved, the attacker gains elevated privileges on the Android device

The vulnerability has a changed scope, meaning successful exploitation impacts resources beyond the vulnerable component's security authority.

Detection Methods for CVE-2026-6920

Indicators of Compromise

• Unusual GPU process crashes or restarts in Chrome on Android devices
• Suspicious memory access patterns in GPU process logs
• Unexpected Chrome renderer crashes followed by abnormal GPU activity
• Signs of sandbox escape attempts or privilege escalation on Android devices

Detection Strategies

• Monitor for unusual Chrome crash reports, particularly those involving the GPU process with memory-related errors
• Implement endpoint detection rules to identify abnormal process behavior following Chrome GPU crashes
• Deploy network monitoring to detect access to known malicious domains serving exploit pages
• Analyze Chrome diagnostic logs for OOB read indicators in GPU operations

Monitoring Recommendations

• Enable verbose logging for Chrome browser processes on managed Android devices
• Configure endpoint protection to alert on sandbox escape attempts
• Monitor for lateral movement or privilege escalation following browser crashes
• Review Chrome Stable channel update notifications for security patches

How to Mitigate CVE-2026-6920

Immediate Actions Required

• Update Google Chrome on Android to version 147.0.7727.117 or later immediately
• Enable automatic updates for Chrome to ensure timely security patch deployment
• Consider restricting browsing on unpatched devices to trusted sites only
• Review and apply enterprise Chrome policies to limit exposure to untrusted content

Patch Information

Google has addressed this vulnerability in Chrome version 147.0.7727.117. The fix is available through the Google Chrome Desktop Update released on April 22, 2026. Additional technical details can be found in the Chromium Issue Tracker #499891888.

Organizations should prioritize deploying this update to all Android devices running Chrome, as the sandbox escape capability significantly elevates the risk profile of this vulnerability.

Workarounds

• Temporarily disable hardware acceleration in Chrome settings if patching is not immediately possible
• Implement web content filtering to block access to untrusted or potentially malicious websites
• Use alternative browsers on Android devices until patches can be deployed
• Apply network-level controls to restrict access to high-risk web content on unpatched devices

For enterprise environments, Chrome's administrative policies can be configured to enforce automatic updates:

# Example: Force Chrome auto-update policy via Android Enterprise
# Ensure automatic updates are enabled in managed Google Play settings
# Device Policy: apps.AutoUpdateMode = AUTO_UPDATE_HIGH_PRIORITY