What is the CVSS score of CVE-2026-6920?

CVE-2026-6920 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-6920?

Google Chrome on Android (versions prior to 147.0.7727.117) contains a critical sandbox escape vulnerability (CVSS 9.6) that could allow attackers to escalate browser compromises into full device…. A patch is available.

How to fix or mitigate CVE-2026-6920?

Within 24 hours, send urgent security advisory to all staff with Android devices and begin inventory of Chrome versions in production use. Within 7 days, deploy Chrome 147.0.7727.117 or later to all Android devices via MDM solutions or provide BYOD users with clear patching instructions, prioritizing devices in high-risk roles. Within 30 days, verify patch adoption above 90%, review endpoint detection logs for sandbox escape indicators, and confirm completion status for your auditors.

Google Chrome CVE-2026-6920

EUVD-2026-25252 CRITICAL

Out-of-bounds Read (CWE-125)

2026-04-23 Chrome

GHSA-wr5x-gh5c-99v2

Buffer Overflow Information Disclosure Google

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires a pre-compromised renderer and crafted page (AC:H, UI:R); primary impact is an OOB memory read (C:H) with only potential, not confirmed, integrity/availability effect (I:L/A:L); scope changes as GPU process is escaped (S:C).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 24, 2026 - 16:39 nvd

Patch available

Severity Changed

Apr 23, 2026 - 19:27 NVD

HIGH CRITICAL

CVSS changed

Apr 23, 2026 - 19:27 NVD

7.5 (HIGH) 9.6 (CRITICAL)

Patch available

Apr 23, 2026 - 19:01 EUVD

Re-analysis Queued

Apr 23, 2026 - 18:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 18:42 NVD

7.5 (None) 7.5 (HIGH)

EUVD ID Assigned

Apr 23, 2026 - 17:30 euvd

EUVD-2026-25252

Analysis Generated

Apr 23, 2026 - 17:30 vuln.today

CVE Published

Apr 23, 2026 - 16:12 nvd

CRITICAL 9.6

DescriptionCVE.org

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's GPU process on Android (versions prior to 147.0.7727.117) can be triggered by an attacker who has already compromised the renderer process, using a crafted HTML page to force an out-of-bounds read (CWE-125) that leaks GPU-process memory and potentially breaks out of the renderer sandbox. Rated High by Chromium and CVSS 9.6, it is a second-stage bug requiring prior renderer compromise. No public exploit identified at time of analysis, and EPSS is low at 0.07% (21st percentile).

Technical ContextAI

The flaw lives in Chrome's GPU process, a privileged component that handles graphics/compositing commands sent from the sandboxed renderer over Chrome's IPC (Mojo) command buffers. CWE-125 (out-of-bounds read) indicates the GPU code reads memory outside an allocated buffer's bounds, typically from insufficient validation of an index, size, or offset supplied by the renderer. Because the GPU process runs with fewer restrictions than the renderer sandbox, an OOB read there can disclose adjacent memory (pointers, heap layout) useful for defeating ASLR and chaining into a sandbox escape. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the description scope this specifically to the Android build of Chrome, though the code is part of shared Chromium GPU stack.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 147.0.7727.117 or later via the Google Play Store / Chrome's built-in updater, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html). No standalone workaround fully mitigates the bug since it is reachable from a crafted web page once a renderer is compromised; as compensating controls until updates roll out, restrict browsing to trusted sites, and because the flaw is in the GPU process, disabling hardware GPU acceleration (chrome://settings → System → 'Use graphics acceleration when available' off, or the ANGLE/GPU flags) can reduce the attack surface at the cost of degraded rendering and battery/performance. Enforcing rapid auto-updates via enterprise MDM/policy is the durable fix.