CVE-2026-12030 is a heap buffer overflow vulnerability in the GPU component of Google Chrome on Android devices. It affects versions before 149.0.7827.115. The vulnerability permits a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape through a crafted HTML page. This could lead to increased privileges or code execution outside the sandbox environment. The vulnerability is recognized as high severity by the Chromium security team. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.

The vulnerability allows a remote attacker with control over the renderer process to potentially escape the sandbox, which could lead to execution of arbitrary code with elevated privileges on the affected device. This increases the risk of compromise beyond the renderer sandbox, potentially affecting the security of the entire system running the vulnerable Chrome version.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01962725236.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when browsing untrusted content on affected versions of Chrome on Android.