CVE-2026-7912: Google Chrome GPU Integer Overflow RCE

CVE-2026-7912 Overview

CVE-2026-7912 is an integer overflow vulnerability in the GPU component of Google Chrome on Android. The flaw affects Chrome versions prior to 148.0.7778.96. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to perform arbitrary read and write operations. Google's Chromium team rated the underlying issue as High security severity, while the CVSS base score reflects the precondition of a compromised renderer.

Critical Impact
Attackers chaining a renderer compromise with this GPU integer overflow can achieve arbitrary read/write primitives, enabling sandbox-escape style memory corruption on Android devices running outdated Chrome builds.

Affected Products

Google Chrome on Android prior to 148.0.7778.96
Google Android (as Chrome host platform)
Chromium-based mobile browsers sharing the same GPU code path

Discovery Timeline

2026-05-06 - CVE-2026-7912 published to NVD
2026-05-06 - Last updated in NVD database
2026-05 - Google releases stable channel update addressing the issue

Technical Details for CVE-2026-7912

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-472] in Chrome's GPU process on Android. The GPU process handles graphics commands forwarded from the renderer through Chrome's IPC channels. When a crafted HTML page issues GPU commands with attacker-controlled size or index parameters, an arithmetic operation wraps past the maximum representable integer value. The wrapped value is then used to size or index a buffer, leading to inconsistent state between allocation and access logic.

Exploitation requires that the attacker first compromise the renderer process, typically through a separate browser bug. With renderer control, the attacker forges GPU IPC messages that trigger the overflow. The resulting mismatch yields out-of-bounds memory access in the more privileged GPU process, providing arbitrary read and write primitives across that process's address space.

Root Cause

The root cause is unchecked arithmetic on attacker-influenced integer inputs handled by the GPU command processing path. Without saturating arithmetic or pre-multiplication bounds checks, the computed buffer dimension wraps and bypasses subsequent validation that assumes the result fits within expected limits.

Attack Vector

The attack chain is network-delivered but requires user interaction and a prior renderer compromise. A victim loads a malicious or compromised page in Chrome on Android. Exploit code in that page first triggers a renderer-side vulnerability, then issues crafted GPU commands that drive the integer overflow. Successful exploitation yields read/write primitives in the GPU process, which can be staged toward broader sandbox escape on the device.

No public proof-of-concept code is available for CVE-2026-7912. Technical details remain under restricted access in the Chromium issue tracker. See the Chromium Issue #497639714 and the Google Chrome Update Announcement for vendor-published information.

Detection Methods for CVE-2026-7912

Indicators of Compromise

Chrome for Android client versions reporting a build older than 148.0.7778.96 in user-agent telemetry or MDM inventories.
Unexpected Chrome GPU process crashes or SIGSEGV signals on Android devices correlated with web browsing activity.
Outbound connections from mobile endpoints to newly registered or low-reputation domains hosting heavily obfuscated JavaScript and WebGL payloads.

Detection Strategies

Inventory installed Chrome versions across managed Android fleets and flag any device running a build below 148.0.7778.96.
Monitor mobile EDR telemetry for repeated Chrome GPU process termination events, which may indicate exploitation attempts or unstable exploit chains.
Inspect web proxy logs for pages serving WebGL or WebGPU content combined with renderer-targeting exploit patterns.

Monitoring Recommendations

Centralize Chrome version data through MDM or UEM platforms and alert on devices missing the patched build after the vendor release window.
Forward mobile browser crash telemetry into a SIEM or data lake to correlate GPU process anomalies with browsing destinations.
Track threat intelligence feeds for emerging exploit kits chaining renderer bugs with GPU vulnerabilities on Android.

How to Mitigate CVE-2026-7912

Immediate Actions Required

Update Google Chrome on Android to version 148.0.7778.96 or later through Google Play.
Enforce automatic Chrome updates on managed Android devices via MDM policy.
Identify devices that cannot update and restrict their access to untrusted web content until patched.

Patch Information

Google addressed CVE-2026-7912 in the stable channel update for Chrome on Android at version 148.0.7778.96. Refer to the Google Chrome Update Announcement for the full release notes and the Chromium Issue #497639714 for the vendor tracker entry.

Workarounds

Restrict browsing to trusted sites on unpatched Android devices using web filtering or DNS-layer controls.
Disable hardware-accelerated graphics features for Chrome through enterprise policy where supported, accepting the performance trade-off.
Use mobile threat defense tooling to block known malicious URLs and exploit infrastructure until devices receive the update.

bash

# Verify deployed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 148.0.7778.96 or higher