CVE-2026-79241: Out of bounds read in Google Chrome

This vulnerability involves an out-of-bounds read in the GPU process of Google Chrome on Android versions before 152.0.7977.65. A remote attacker can exploit this by crafting a malicious HTML page that triggers the GPU to read memory outside its sandbox boundaries. The vulnerability impacts confidentiality by allowing unauthorized memory disclosure but does not affect integrity or availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The issue is fixed in Chrome version 152.0.7977.65 as per the vendor advisory.

Successful exploitation allows a remote attacker to read memory outside the sandbox on affected Chrome versions on Android, potentially exposing sensitive information. There is no impact on system integrity or availability. No active exploits have been reported.

Google has released an official fix in Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. No additional mitigation is required beyond applying the official update.