Google Chrome for Android is vulnerable to a sandbox escape and arbitrary code execution flaw triggered by improper GPU input validation, posing a significant risk to user security.

This vulnerability involves improper input validation within the GPU process, which allows an unauthenticated remote attacker, who has already gained control of the renderer process, to escape the application sandbox and execute arbitrary code.

A successful exploit allows an attacker to bypass critical security boundaries, leading to potential full system compromise, data theft, or malware installation on the affected Android device. With a CVSS score of 8.3, this high-severity vulnerability represents a significant risk to organizational mobility security, as it could facilitate lateral movement or the exfiltration of sensitive corporate data stored on mobile endpoints.

Immediate Action: Update Google Chrome on all Android devices to the latest stable version provided by the Google Play Store to ensure the vulnerable GPU component is patched.

Proactive Monitoring: Review mobile endpoint logs for signs of anomalous application behavior or unexpected crashes that may indicate an attempt to exploit renderer process vulnerabilities.

Compensating Controls: Ensure that Google Play Protect is enabled and active on all managed Android devices to provide an additional layer of defense against malicious applications or web content.

Public Exploit Available: No

Given the high CVSS score and the nature of sandbox escape vulnerabilities, it is imperative that organizations prioritize the deployment of the latest Chrome version across their mobile fleet. Administrators should verify that automatic updates are enabled or push the update via Mobile Device Management (MDM) solutions immediately to mitigate the risk of arbitrary code execution.