This vulnerability is an out-of-bounds read in the GPU component of Google Chrome on Android versions before 147.0.7727.117. An attacker with control over the renderer process could exploit this flaw via a specially crafted HTML page to potentially escape the sandbox, increasing the risk of further compromise. The issue is tracked as CVE-2026-6920 with a CVSS 3.1 base score of 7.5 (High), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. The vulnerability is categorized under CWE-125.

Successful exploitation could allow a remote attacker who has compromised the renderer process to escape the sandbox environment, potentially leading to increased privileges or access beyond the renderer sandbox. Confidentiality impact is high, but integrity and availability impacts are not indicated. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official fixes once available. Until then, no specific mitigation steps are confirmed by the vendor.