An out-of-bounds read vulnerability (CWE-125) exists in the GPU component of Google Chrome on Android prior to version 147.0.7727.117. This vulnerability can be triggered by a remote attacker who has compromised the renderer process, enabling a potential sandbox escape via a crafted HTML page. The issue is rated critical with a CVSS 3.1 score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory linked does not explicitly state patch availability or remediation level, and no known exploits have been reported.

Successful exploitation could allow an attacker who has compromised the renderer process to escape the sandbox, potentially leading to full compromise of the affected device. The vulnerability affects confidentiality, integrity, and availability at a high level. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_22.html for current remediation guidance. Users should update Google Chrome on Android to version 147.0.7727.117 or later once confirmed. Until then, exercise caution with untrusted content and avoid visiting suspicious websites.