CVE-2026-79241 Overview
CVE-2026-79241 is an out-of-bounds read vulnerability [CWE-125] in the GPU component of Google Chrome on Android. Versions prior to 152.0.7977.65 are affected. A remote attacker can serve a crafted HTML page to read memory outside the Chrome sandbox. Chromium classifies the security severity as Medium.
The flaw enables information disclosure across the process boundary that normally isolates renderer content from GPU-resident memory. Successful exploitation exposes memory contents that may include sensitive data or facilitate follow-on exploitation.
Critical Impact
Remote attackers can read memory outside the Chrome sandbox on Android devices by luring users to a malicious web page.
Affected Products
- Google Chrome for Android versions prior to 152.0.7977.65
- Chromium-based components sharing the vulnerable GPU code path
- Android applications embedding vulnerable Chrome/WebView builds
Discovery Timeline
- 2026-08-25 - CVE-2026-79241 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79241
Vulnerability Analysis
The vulnerability resides in Chrome's GPU process on Android. The GPU process handles hardware-accelerated rendering commands issued by renderer processes on behalf of web content. An out-of-bounds read occurs when the GPU code path accesses memory beyond the intended buffer boundary while processing attacker-influenced input from a crafted HTML page.
Because the read crosses the sandbox boundary, attackers obtain data that renderer processes should not observe. Disclosed memory contents can include GPU buffer residue, pointers useful for defeating address space layout randomization (ASLR), or fragments of other web contexts. See the Chromium Issue Tracker entry for the upstream report.
Root Cause
The root cause is missing or incorrect bounds validation on data structures processed inside the GPU component. Under [CWE-125], the code reads from a memory location determined by an index or pointer that has not been correctly constrained to the allocated region. A crafted HTML page shapes the inputs to trigger the boundary violation.
Attack Vector
Exploitation is remote and requires user interaction. The victim must load an attacker-controlled HTML page in a vulnerable Chrome build on Android. The page issues GPU-accelerated content that steers the vulnerable code path into reading past a buffer. The Exploit Prediction Scoring System (EPSS) rates near-term exploitation likelihood as low based on data published on 2026-08-27.
No verified exploit code is publicly available. Refer to the Google Chrome Stable Update announcement for vendor context.
Detection Methods for CVE-2026-79241
Indicators of Compromise
- Android devices running Chrome builds earlier than 152.0.7977.65 that browsed untrusted sites
- Unexpected Chrome GPU process crashes or renderer terminations logged in logcat
- Outbound traffic from mobile endpoints to newly registered domains delivering GPU-heavy WebGL or canvas payloads
Detection Strategies
- Inventory Chrome for Android versions across managed mobile devices and flag anything below 152.0.7977.65.
- Correlate mobile web proxy logs with threat intelligence for domains hosting exploit kits targeting Chromium GPU flaws.
- Monitor mobile threat defense (MTD) telemetry for browser process anomalies coinciding with page loads.
Monitoring Recommendations
- Ingest mobile device management (MDM) compliance data into your security data lake to track Chrome patch status.
- Alert on repeated Chrome crashes tied to the GPU process, which can indicate exploitation attempts.
- Track user reports of browser instability after visiting untrusted links.
How to Mitigate CVE-2026-79241
Immediate Actions Required
- Update Google Chrome for Android to 152.0.7977.65 or later through the Google Play Store.
- Push the update via MDM to enforce compliance across managed Android fleets.
- Restrict browsing to trusted sites on devices that cannot be updated immediately.
Patch Information
Google addressed the issue in Chrome Stable channel release 152.0.7977.65 for Android. Details are published in the Google Chrome Stable Update announcement. The upstream fix is tracked in the Chromium Issue Tracker entry #514508415.
Workarounds
- Disable hardware acceleration in Chrome flags on affected Android devices as a temporary risk reduction measure.
- Use enterprise browser policies to block known malicious domains and restrict WebGL where feasible.
- Educate users to avoid clicking untrusted links until the patched build is installed.
# Verify Chrome for Android version via adb
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
