Out of bounds write in GPU in Google Chrome on Android prior to 149

CVE-2026-10892 is an out-of-bounds write in Chrome's GPU path on Android. In plain English: malicious web content can push Chrome into writing past a memory boundary, which can corrupt process memory and, per Google's description and the CVE text, potentially lead to a sandbox escape. The affected population is Google Chrome on Android before 149.0.7827.53.

Google's own bug taxonomy calls this one Critical, and that is fair from a pure browser-exploitation standpoint: remote content touching memory safety in a browser GPU component is never a joke. But for enterprise patch triage, reality lands at HIGH, not CRITICAL because the chain is still client-side, still requires user interaction with attacker-controlled content, is limited to Android Chrome rather than every Chrome platform, and currently has no KEV entry, no public PoC, and no vendor statement of in-the-wild exploitation.

Why this verdict

• Baseline set high by impact: browser memory corruption tied to a *potential sandbox escape* on a ubiquitous browser deserves an aggressive starting point even without CVSS
• Downward pressure for attacker reachability: the attacker position is *unauthenticated remote*, but only through user-driven browsing to malicious content; this is not a passive network hit or wormable service
• Downward pressure for exposure population: the bug is limited to Chrome on Android, which is a large fleet segment for some orgs but still narrower than all Chrome platforms or a server product
• Downward pressure for exploit maturity: there is no KEV listing, no vendor exploitation warning, and no public PoC in the open-source search set reviewed
• Upward pressure for consequence: if the described *potential sandbox escape* is reliably weaponized, impact moves beyond a mere renderer crash into device-level compromise territory for the targeted handset

Why not higher?

CRITICAL would require either much broader reachable population or stronger evidence that exploitation is already practical at scale. Here, the chain still depends on hostile web content reaching a user on Android Chrome, and the current public signal around weaponization is weak.

Why not lower?

This is still a browser memory-safety flaw in the GPU path with a stated *potential sandbox escape*, not a cosmetic DoS. Even without exploitation evidence, the technical upside for a capable attacker is serious enough that this should stay above routine backlog work.

1. Force Chrome updates from EMM — Use Android Enterprise managed Google Play or your EMM/MDM to push Chrome 149.0.7827.53 or later and verify install compliance. For a HIGH verdict, deploy this control within 30 days if patching cannot be completed immediately.
2. Quarantine outdated Android devices — Build a dynamic group for devices with com.android.chrome below 149.0.7827.53 and restrict access to sensitive SaaS, SSO, or corp resources until updated. This cuts the business blast radius while you close patch compliance, and it should be in place within 30 days.
3. Tighten mobile web-risk controls — Enable or validate Safe Browsing, mobile threat defense, DNS filtering, and secure web gateway policies for Android traffic to reduce initial delivery from malicious or compromised sites. These are mitigation-only controls and should be enforced within 30 days.
4. Prefer managed Chrome only — Block sideloaded browser builds and standardize on managed Play-distributed Chrome so version inventory is trustworthy and updates are enforceable. For this HIGH issue, make that policy correction within 30 days where gaps exist.

Run this on an auditor workstation with adb installed and a USB- or network-connected Android device. Invoke it as bash check_chrome_android_cve_2026_10892.sh <device-serial> or omit the serial if only one device is connected; it needs adb shell access only, no root.

#!/usr/bin/env bash
# check_chrome_android_cve_2026_10892.sh
# Verify whether Google Chrome on an Android device is vulnerable to CVE-2026-10892
# Affected: Chrome on Android versions prior to 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/tooling error

set -u

TARGET_VERSION="149.0.7827.53"
SERIAL="${1:-}"
ADB_BIN="${ADB_BIN:-adb}"
PACKAGE="com.android.chrome"

fail() {
  echo "UNKNOWN: $1"
  exit 2
}

need_cmd() {
  command -v "$1" >/dev/null 2>&1 || {
    echo "UNKNOWN: required command not found: $1"
    exit 3
  }
}

version_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

need_cmd "$ADB_BIN"
need_cmd sort
need_cmd awk
need_cmd sed

ADB=("$ADB_BIN")
if [ -n "$SERIAL" ]; then
  ADB+=("-s" "$SERIAL")
fi

STATE="$(${ADB[@]} get-state 2>/dev/null || true)"
if [ "$STATE" != "device" ]; then
  fail "adb device not available; connect/unlock device and authorize adb"
fi

PKG_INFO="$(${ADB[@]} shell dumpsys package "$PACKAGE" 2>/dev/null | tr -d '\r')"
if [ -z "$PKG_INFO" ]; then
  fail "unable to query package info for $PACKAGE"
fi

VERSION_NAME="$(printf '%s\n' "$PKG_INFO" | sed -n 's/.*versionName=\([^[:space:]]*\).*/\1/p' | head -n1)"
VERSION_CODE="$(printf '%s\n' "$PKG_INFO" | sed -n 's/.*versionCode=\([0-9][0-9]*\).*/\1/p' | head -n1)"

if [ -z "$VERSION_NAME" ]; then
  fail "Chrome package not installed or versionName unavailable"
fi

if version_ge "$VERSION_NAME" "$TARGET_VERSION"; then
  echo "PATCHED: $PACKAGE version $VERSION_NAME (versionCode=${VERSION_CODE:-unknown}) is >= $TARGET_VERSION"
  exit 0
else
  echo "VULNERABLE: $PACKAGE version $VERSION_NAME (versionCode=${VERSION_CODE:-unknown}) is < $TARGET_VERSION"
  exit 1
fi

Sources

1. Chrome Releases - Stable Channel Update for Desktop (lists CVE-2026-10892 as Critical)
2. Chrome Releases - Chrome for Android Update (149.0.7827.48 early stable baseline)
3. Chrome Releases homepage / 2026 archive
4. Chromium issue tracker entry referenced by release notes
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS data and statistics
7. FIRST API documentation for EPSS
8. Canadian Centre for Cyber Security advisory referencing June 2026 Chrome fixes