This vulnerability (CVE-2026-9889) affects Google Chrome on Android versions before 148.0.7778.216. It is caused by out of bounds read and write flaws in the Dawn component, which could be exploited remotely via a crafted HTML page to potentially escape the browser sandbox. The issue is classified under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow a remote attacker to escape the sandbox environment of Google Chrome on Android, potentially leading to arbitrary code execution with elevated privileges. This could compromise the confidentiality, integrity, and availability of the affected device. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Since the advisory does not explicitly state a fix or update availability, users and administrators should monitor official Google Chrome release notes for updates addressing this vulnerability. Until a patch is confirmed, avoid visiting untrusted or suspicious websites that could deliver crafted HTML content.