Google Chrome EUVD-2026-65936

Exploitation requires two sequential conditions to be met: the attacker must first achieve code execution within Chrome's renderer process via a separate chained vulnerability, and the victim must be running Google Chrome on Android with a version prior to 152.0.7977.65. The victim must also actively visit a crafted HTML page (UI:R), which delivers the renderer exploit. The Android platform restriction limits this flaw to Android Chrome installations - desktop Chrome on Windows, macOS, or Linux is not affected per this advisory. Limiting factors include: the AC:H prerequisite of a functional renderer exploit chain, mandatory user interaction to visit the malicious page, and the Android-only scope. The specific GPU hardware model or Android OS version are not identified as further constraints in available data, though this is not confirmed from the advisory.

The CVSS 8.3 score (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) accurately captures this vulnerability's structure: AC:H is correct because exploitation requires a prior renderer process compromise, making this a second-stage flaw in an exploit chain. The EPSS score of 0.42% (35th percentile) signals low current exploitation probability, consistent with the significant technical barrier of chaining two distinct browser exploits - opportunistic, mass exploitation is unlikely. The vulnerability is not listed in CISA KEV and no public exploit code has been identified, reinforcing the low near-term exploitation probability. However, the scope change (S:C) and full C:H/I:H/A:H ratings reflect that a successful sandbox escape yields OS-level code execution, representing a complete browser compromise. The divergence between the high CVSS base score and low EPSS is best explained by the chained-exploit prerequisite, which limits mass campaigns while leaving targeted attacks by sophisticated actors entirely feasible. Organizations that treat Chrome's sandbox as a meaningful security control - particularly those managing Android fleets in high-risk environments - should prioritize patching despite the low EPSS, since targeted exploitation does not require broad weaponization.

An attacker hosts a crafted HTML page that first exploits a separate, chained renderer vulnerability to achieve code execution within Chrome's sandboxed renderer process on a victim's Android device. Once renderer execution is established, the attacker submits malformed GPU commands that bypass input validation in Chrome's GPU process, escaping the sandbox and achieving arbitrary code execution at OS process privilege on the Android system. No public proof-of-concept exploit for this specific flaw has been identified; full exploitation requires constructing or acquiring a two-stage exploit chain targeting both the renderer and this GPU escape.