CVE-2026-16424

No known exploitation. EPSS puts it in the 27th percentile. Fixed in 150.0.7871.182.

CVSS 3.19.6Critical EPSS percentile27th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix150.0.7871.182Upgrade to this build

Published 2026-07-21Updated 2026-07-24Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Google ChromeAffected: ≥ 150.0.7871.182, < 150.0.7871.182Upgrade to: 150.0.7871.182Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which Google Chrome version is installed on your Android devices.
Confirm whether any users can open untrusted web content (links, emails, web pages) on those devices.
Update Google Chrome on Android to 150.0.7871.182 or later.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

In plain language

Written by AI from the record

CVE-2026-16424 is a serious Google Chrome on Android bug where, after an attacker already takes over Chrome’s renderer, they may escape Chrome’s safety barriers; most small businesses are only affected if your devices are running an old Chrome version and are exposed to hostile content.

CVE-2026-16424 is a use-after-free in the GPU component of Google Chrome on Android prior to 150.0.7871.182, where a remote attacker who has already compromised the renderer process may use it to escape the sandbox.

If you're affected

Browser sandbox escape
Device compromise risk
Sensitive data exposure
Operational disruption

What is it

This flaw is in Chrome’s GPU handling on Android. A “use-after-free” bug means Chrome can end up using memory that should no longer be in use. If an attacker has already gained control of part of the browser (the renderer), this bug could help them break out of Chrome’s safety sandbox and gain higher access.

Who is affected

This matters if your business uses Google Chrome on Android on staff or customer devices and those devices can visit untrusted websites or open risky content. The scenario described requires an attacker to have already compromised Chrome’s renderer process, so it’s not a straight “visit a site and you’re hacked” issue. Reachability depends on whether hostile content can get the attacker to a point where the renderer is compromised, and then a user interaction is involved.

How urgent is it

This is an AMBER issue because it’s a high-impact browser escape, but it depends on a prior step (the attacker already compromising the renderer process). There’s no public exploit code on record and it’s not listed in CISA KEV, so broad automated scanning is less likely. Still, you should update promptly because the fixed version is available.

What to do — in detail

Confirm exposure

On each Android device, open Google Chrome and go to the version page (typically via Chrome’s menu → Settings → About Chrome).
Determine whether the device is on a version prior to 150.0.7871.182.

Remediate (recommended)

Update Google Chrome on Android to 150.0.7871.182 or later.
If you manage devices through a business mobile management tool, prefer pushing the Chrome update to all managed Android endpoints and verifying the deployed version afterward.

If you can’t update immediately

Reduce exposure by limiting access to untrusted sites and file-sharing/download links from mobile devices.
Ensure users are discouraged from opening unexpected links in messages or emails on Android.
Consider temporarily restricting access to high-risk browsing contexts (for example, guest Wi‑Fi networks or devices used primarily for browsing unknown content) until updates are applied.

What to monitor

Any security tooling/MDM alerts related to suspicious Chrome behavior or browser crashes followed by unusual device activity.
User reports of unexpected prompts, navigation to strange pages, or sudden browser instability after visiting links.

Technical context

Severity: Critical (CVSS 9.6 reported in the source). Weakness type: CWE-416 (use-after-free). Mechanism: a use-after-free in the GPU component of Google Chrome on Android. Attack vector: network delivery leading to a user interaction, but with a key precondition: the attacker must already have compromised the renderer process; then the attacker may be able to escape the sandbox to gain higher privileges.

KEV status: not listed in CISA KEV. Exploitation status: no public exploit code on record; exploitation in the wild is not confirmed by the provided findings. EPSS: 0.2% with a flat trend, but this is only predictive and is not a basis for delaying action when a fix is available.

Fix availability: Google Chrome is fixed in 150.0.7871.182.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS27th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 27th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 3 days, from the signal feeds we watch.

2026-07-24OpenVAS check addedpatch available, record updated
2026-07-23Record updated
2026-07-22Record updated
2026-07-21Publishedweakness classified, att&ck mapped, record updated

Affected products

Googlecommercial · USaka google llc, google inc
- ChromeDesktop AppOn-premConsumer Software / browser

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Scored 9.6 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable