CVE-2026-16424 is a use-after-free vulnerability in the GPU subsystem of Google Chrome on Android platforms before version 150.0.7871.182. Exploitation requires that the attacker has already compromised the renderer process. By leveraging this vulnerability via a specially crafted HTML page, the attacker may achieve sandbox escape, thereby gaining elevated privileges beyond the renderer sandbox. The vulnerability has a CVSS 3.1 base score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to sandbox escape from the renderer process, allowing an attacker to execute code with higher privileges on the affected Android device. This compromises the security boundaries intended to isolate web content, potentially leading to full device compromise or data exposure.

Google has released an update in Chrome version 150.0.7871.182 that addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. Patch status is not explicitly stated in the advisory link provided, but the presence of the version number indicates the fix is included in that release. No additional mitigation steps are specified by the vendor.