CVE-2026-7912: Google Chrome GPU Integer Overflow RCE

CVE-2026-7912 Overview

CVE-2026-7912 is an integer overflow vulnerability in the GPU component of Google Chrome on Android. The flaw affects Chrome versions prior to 148.0.7778.96. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to perform arbitrary read and write operations. Google's Chromium team rated the underlying issue as High security severity, while the CVSS base score reflects the precondition of a compromised renderer.

Critical Impact

Attackers chaining a renderer compromise with this GPU integer overflow can achieve arbitrary read/write primitives, enabling sandbox-escape style memory corruption on Android devices running outdated Chrome builds.

Affected Products

• Google Chrome on Android prior to 148.0.7778.96
• Google Android (as Chrome host platform)
• Chromium-based mobile browsers sharing the same GPU code path

Discovery Timeline

• 2026-05-06 - CVE-2026-7912 published to NVD
• 2026-05-06 - Last updated in NVD database
• 2026-05 - Google releases stable channel update addressing the issue

Technical Details for CVE-2026-7912

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-472] in Chrome's GPU process on Android. The GPU process handles graphics commands forwarded from the renderer through Chrome's IPC channels. When a crafted HTML page issues GPU commands with attacker-controlled size or index parameters, an arithmetic operation wraps past the maximum representable integer value. The wrapped value is then used to size or index a buffer, leading to inconsistent state between allocation and access logic.

Exploitation requires that the attacker first compromise the renderer process, typically through a separate browser bug. With renderer control, the attacker forges GPU IPC messages that trigger the overflow. The resulting mismatch yields out-of-bounds memory access in the more privileged GPU process, providing arbitrary read and write primitives across that process's address space.

Root Cause

The root cause is unchecked arithmetic on attacker-influenced integer inputs handled by the GPU command processing path. Without saturating arithmetic or pre-multiplication bounds checks, the computed buffer dimension wraps and bypasses subsequent validation that assumes the result fits within expected limits.

Attack Vector

The attack chain is network-delivered but requires user interaction and a prior renderer compromise. A victim loads a malicious or compromised page in Chrome on Android. Exploit code in that page first triggers a renderer-side vulnerability, then issues crafted GPU commands that drive the integer overflow. Successful exploitation yields read/write primitives in the GPU process, which can be staged toward broader sandbox escape on the device.

No public proof-of-concept code is available for CVE-2026-7912. Technical details remain under restricted access in the Chromium issue tracker. See the Chromium Issue #497639714 and the Google Chrome Update Announcement for vendor-published information.

Detection Methods for CVE-2026-7912

Indicators of Compromise

• Chrome for Android client versions reporting a build older than 148.0.7778.96 in user-agent telemetry or MDM inventories.
• Unexpected Chrome GPU process crashes or SIGSEGV signals on Android devices correlated with web browsing activity.
• Outbound connections from mobile endpoints to newly registered or low-reputation domains hosting heavily obfuscated JavaScript and WebGL payloads.

Detection Strategies

• Inventory installed Chrome versions across managed Android fleets and flag any device running a build below 148.0.7778.96.
• Monitor mobile EDR telemetry for repeated Chrome GPU process termination events, which may indicate exploitation attempts or unstable exploit chains.
• Inspect web proxy logs for pages serving WebGL or WebGPU content combined with renderer-targeting exploit patterns.

Monitoring Recommendations

• Centralize Chrome version data through MDM or UEM platforms and alert on devices missing the patched build after the vendor release window.
• Forward mobile browser crash telemetry into a SIEM or data lake to correlate GPU process anomalies with browsing destinations.
• Track threat intelligence feeds for emerging exploit kits chaining renderer bugs with GPU vulnerabilities on Android.

How to Mitigate CVE-2026-7912

Immediate Actions Required

• Update Google Chrome on Android to version 148.0.7778.96 or later through Google Play.
• Enforce automatic Chrome updates on managed Android devices via MDM policy.
• Identify devices that cannot update and restrict their access to untrusted web content until patched.

Patch Information

Google addressed CVE-2026-7912 in the stable channel update for Chrome on Android at version 148.0.7778.96. Refer to the Google Chrome Update Announcement for the full release notes and the Chromium Issue #497639714 for the vendor tracker entry.

Workarounds

• Restrict browsing to trusted sites on unpatched Android devices using web filtering or DNS-layer controls.
• Disable hardware-accelerated graphics features for Chrome through enterprise policy where supported, accepting the performance trade-off.
• Use mobile threat defense tooling to block known malicious URLs and exploit infrastructure until devices receive the update.

# Verify deployed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 148.0.7778.96 or higher