Arm GPU Userspace Driver EUVD-2026-72799

The target device must have an Arm Bifrost, Valhall, or 5th Gen GPU with a userspace driver revision within the affected ranges (r42p0-r51p0 or r54p1-r54p3 for Bifrost; r42p0-r54p3 or r55p0 for Valhall and 5th Gen). Exploitation requires the attacker to execute GPU processing operations - either as a local unprivileged native process (PR:L) or through browser-based WebGL/WebGPU, which any standard browser on the affected device will expose. No elevated privileges, special configuration, or administrator access is required beyond normal user-level process access. Limiting factors: the device must carry one of the three specific Arm GPU families with a vulnerable driver revision; the crafted GPU command sequence must be precisely engineered to trigger the freed-memory reference; and exploitation is bounded to the scope of the affected process (S:U), meaning kernel-level compromise requires an additional privilege escalation step beyond this CVE.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitation by an unprivileged process with no user interaction required, and the C:H/I:H/A:H impact cluster indicates potential arbitrary memory read/write and code execution within the affected process context. The WebGL/WebGPU attack surface complicates the pure-local framing, since browsers running on affected devices constitute a practical delivery channel - even a mid-sized municipal IT team in koszalin managing a fleet of Arm-based Android handsets should treat this as an actionable patch priority rather than a theoretical local-only issue. EPSS at 0.14% (4th percentile) signals no observed mass exploitation, and CISA KEV does not list this CVE, consistent with no public exploit code being referenced. The S:U (unchanged scope) limits blast radius to the process sandbox. Real-world exploitation probability is constrained by the need to target specific affected driver revisions and craft precise GPU command sequences, but the broad version range (r42p0 through r55p0 across three architectures) means a very large installed base remains potentially exposed.

A threat actor hosts a malicious web page containing crafted WebGL or WebGPU shader operations designed to trigger the use-after-free condition in the Arm userspace GPU driver on an affected Android device. A victim visits the page in any browser on the device; the browser's GPU process submits the attacker-controlled GPU commands to the vulnerable driver, causing a freed memory region to be accessed and enabling the attacker to read sensitive in-process memory or achieve code execution within the GPU process context. No public proof-of-concept code has been identified at time of analysis, so this scenario remains theoretical but technically plausible given the browser-accessible trigger surface.