Description

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-06T22:16:55.690Z",
  "pubdate": "2026-08-06T22:16:55.690Z",
  "executiveSummary": "This vulnerability is a use-after-free weakness affecting the WebGL component in Google Chrome on Android prior to version 151.0.7922.109. The flaw carries a critical security severity rating and permits a remote attacker who has already compromised the renderer process to potentially execute a sandbox escape using a maliciously crafted HTML page.\nThe risk implications are severe, as escaping the browser sandbox allows malicious code to interact with the underlying operating system beyond the security boundaries enforced by the browser architecture. Successful exploitation requires an attacker to first achieve code execution within the restricted renderer process context, typically by luring a target to load a specially crafted webpage containing malicious WebGL content.\nAffected systems include Google Chrome on Android running versions earlier than 151.0.7922.109. Defensive remediation requires updating the browser to the patched version provided by the vendor to eliminate the underlying memory management defect in the WebGL subsystem.",
  "technicalDetails": "The vulnerability stems from a use-after-free condition located within the WebGL graphics subsystem of Google Chrome on Android. A use-after-free vulnerability arises when dynamic memory is incorrectly managed, leading to a pointer referencing a memory address after that memory has been deallocated or freed. If the application continues to reference the dangling pointer, subsequent memory allocations can overwrite the reclaimed space, leading to undefined behavior, memory corruption, or arbitrary code execution.\nIn the context of this flaw, the vulnerable component is the WebGL implementation handling graphics rendering operations inside the renderer process. The exploitation lifecycle begins when an attacker lures a victim into navigating to a crafted HTML page containing malicious WebGL instructions. Prior to triggering this vulnerability, the attacker must have already achieved code execution within the isolated browser renderer process, typically through a distinct vulnerability or exploitation vector.\nOnce the renderer process is compromised, the crafted HTML page triggers improper object lifecycle management within the WebGL engine, causing a resource to be freed while a reference to it remains active. By manipulating heap layouts and causing controlled re-allocations of the freed memory block, the attacker forces the dangling pointer to reference attacker-controlled data structured to mimic legitimate objects or function pointers.\nWhen the WebGL subsystem subsequently attempts to access the dangling pointer, it executes attacker-supplied instructions or achieves arbitrary read/write primitives within the renderer context. Leveraging this state and the specific nature of the memory corruption within the browser architecture, the malicious payload achieves a sandbox escape, allowing execution to break out of the restricted renderer sandbox and potentially compromise the broader Android system environment depending on privileges and further exploitation."
}