Race in GPU in Google Chrome on Android prior to 149

CVE-2026-11082 is a race condition in Chrome's GPU component on Android affecting versions before 149.0.7827.53. The bug is not a clean one-shot internet RCE by itself; the published description says the attacker must have already compromised the renderer process and then use crafted HTML to push malicious GPU work across the renderer→GPU boundary to attempt a sandbox escape. Because it is Android Chrome, the affected population is large in raw install count, but the vulnerable condition sits in the second stage of an exploit chain, not the first.

Google's vendor label of CRITICAL / 9.6 overstates enterprise patch urgency if you are prioritizing by *real attack path friction*. The decisive downgrade is that this bug assumes prior code execution or equivalent control inside the renderer, which means the attacker has already burned a separate browser bug to get there. That said, it does not fall to LOW because Chrome's own Android sandbox architecture documents that the GPU process is unsandboxed on Android, so a successful hit can materially advance a real-world chain from renderer foothold to browser-equivalent app privileges.

Why this verdict

• Major downgrade: requires prior renderer compromise. That implies the attacker already succeeded with a separate bug, so this is post-initial-compromise inside the browser, not first-contact exploitation.
• Further downgrade: client-side reachability is user-driven. The victim still has to browse to attacker content and the chain must survive browser mitigations plus Android device diversity.
• Partial uplift: Android GPU is unsandboxed. Chromium documentation says Android GPU runs unsandboxed and with the browser UID, so if the race lands it has real chain-completion value.

Why not higher?

If this were reachable directly from the web without first compromising the renderer, the vendor's CRITICAL framing would be much closer to reality. But the prerequisite chain is doing the real work here: internal renderer control, crafted GPU interaction, and race reliability on heterogeneous Android hardware are cumulative friction points that sharply narrow practical exploitation.

Why not lower?

This is not just a harmless crash bug. On Android, the GPU process is materially less isolated than defenders often assume, so a successful race can break out of renderer confinement and upgrade an attacker from a sandboxed foothold to a more privileged browser context. That makes it more than backlog trivia.

1. Enforce Chrome auto-update via MDM and managed Play — Make sure enterprise Android devices cannot linger below 149.0.7827.53. For a MEDIUM verdict there is no mitigation SLA in noisgate; use this as an exposure-reduction control while driving to the 365-day remediation window.
2. Prioritize high-risk Android cohorts — Move executives, admins, developers, and users who browse untrusted content to the front of the update queue because this bug is most useful when paired with a separate renderer exploit. For MEDIUM, there is no mitigation SLA — go straight to remediation planning within 365 days, but risk-based cohorting reduces the chance that a rare full chain lands where it hurts most.
3. Reduce unmanaged browser variance — Standardize on a managed Chrome channel and block sideloaded or stale alternate Chromium builds where policy allows. This helps because exploit writers benefit from device and version sprawl; for MEDIUM, keep this as hygiene while you complete remediation inside the 365-day window.
4. Monitor Chrome crash telemetry on Android — Watch for spikes in Chrome GPU-process crashes or abnormal browser instability across managed devices, especially in user groups exposed to hostile web content. This will not prevent exploitation, but it can surface failed race attempts while you work the MEDIUM remediation track.

Run this from an auditor workstation that has adb installed and a managed Android device connected over USB or enterprise-enabled ADB. Invoke it as python3 check_cve_2026_11082.py --serial <device-serial>; it needs no root on the phone, only ADB access and permission to query the installed Chrome package.

#!/usr/bin/env python3
# check_cve_2026_11082.py
# Verifies whether Google Chrome on a connected Android device is below 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/ADB ERROR

import argparse
import re
import subprocess
import sys

TARGET_PKG = "com.android.chrome"
FIXED_VERSION = "149.0.7827.53"


def run(cmd):
    try:
        return subprocess.run(cmd, capture_output=True, text=True, check=False)
    except FileNotFoundError:
        print("UNKNOWN: adb not found in PATH")
        sys.exit(3)


def normalize(v):
    nums = re.findall(r"\d+", v or "")
    return tuple(int(x) for x in nums)


def compare_versions(a, b):
    ta = list(normalize(a))
    tb = list(normalize(b))
    maxlen = max(len(ta), len(tb))
    ta += [0] * (maxlen - len(ta))
    tb += [0] * (maxlen - len(tb))
    if ta < tb:
        return -1
    if ta > tb:
        return 1
    return 0


def get_version(serial=None):
    base = ["adb"]
    if serial:
        base += ["-s", serial]

    # Ensure device is reachable
    probe = run(base + ["get-state"])
    if probe.returncode != 0 or "device" not in (probe.stdout + probe.stderr):
        print("UNKNOWN: device not reachable via adb")
        sys.exit(2)

    # Try dumpsys package first
    cmd = base + ["shell", "dumpsys", "package", TARGET_PKG]
    res = run(cmd)
    text = (res.stdout or "") + "\n" + (res.stderr or "")

    patterns = [
        r"versionName=([^\s]+)",
        r"versionName:\s*([^\s]+)",
    ]
    for pat in patterns:
        m = re.search(pat, text)
        if m:
            return m.group(1).strip()

    # Fallback to pm dump
    cmd = base + ["shell", "pm", "dump", TARGET_PKG]
    res = run(cmd)
    text = (res.stdout or "") + "\n" + (res.stderr or "")
    for pat in patterns:
        m = re.search(pat, text)
        if m:
            return m.group(1).strip()

    return None


def main():
    parser = argparse.ArgumentParser(description="Check Android Chrome for CVE-2026-11082 exposure")
    parser.add_argument("--serial", help="adb device serial", default=None)
    args = parser.parse_args()

    version = get_version(args.serial)
    if not version:
        print("UNKNOWN: could not determine installed Chrome version")
        sys.exit(2)

    cmp_result = compare_versions(version, FIXED_VERSION)
    if cmp_result < 0:
        print(f"VULNERABLE: {TARGET_PKG} version {version} is below fixed version {FIXED_VERSION}")
        sys.exit(1)
    elif cmp_result >= 0:
        print(f"PATCHED: {TARGET_PKG} version {version} is at or above fixed version {FIXED_VERSION}")
        sys.exit(0)

    print("UNKNOWN: unexpected comparison state")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. Chromium Docs - Chrome Android Sandbox Design
2. Chromium Docs - Unsandboxed Processes by Platform
3. Chrome Releases blog
4. VulDB entry for CVE-2026-11082
5. CVE.org record
6. NVD entry
7. FIRST EPSS API
8. CISA Known Exploited Vulnerabilities Catalog