CVE-2026-10892

CriticalCVSS 9.6/10Last modified Jul 22, 2026

Description

Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1089204.3A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Ad CVE-2026-1089217.3A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the fun CVE-2026-1089226.3A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function ge CVE-2026-1089236.3A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file CVE-2026-1089244.3A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file CVE-2026-1089256.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web CVE-2026-1089266.3A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebap CVE-2026-1089276.3A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the fil CVE-2026-1089286.3A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the fi CVE-2026-1089299.9A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the compon CVE-2026-108938.8Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious netwo CVE-2026-1089302.7A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_lis