Description

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-06T22:16:59.480Z",
  "pubdate": "2026-08-06T22:16:59.480Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the WebGL component of Google Chrome on Android prior to version 151.0.7922.109. This memory corruption flaw allows a remote attacker to potentially execute arbitrary code and achieve a sandbox escape via a specially crafted HTML page. The vulnerability presents significant risk due to its severity classification as Critical, enabling potential compromise of the underlying operating system beyond the browser's security boundaries. Exploitation requires a user to visit a malicious webpage rendered by the affected browser instance, leveraging browser-based attack vectors without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the WebGL implementation of Google Chrome on Android, specifically within memory management routines handling graphics processing unit (GPU) context operations and resource lifecycle management. A use-after-free condition occurs when the application continues to reference a memory object after it has been deallocated or freed. This typically stems from improper pointer arithmetic, race conditions, or flawed reference counting within the WebGL state machine or rendering pipeline.\nAttack execution begins when a remote attacker delivers a crafted HTML page containing malicious JavaScript and WebGL API calls to the target via the network. When the browser processes the malicious HTML and executes the corresponding WebGL commands, it triggers improper memory reuse of a freed heap object. By carefully manipulating the heap layout through heap spraying or similar memory grooming techniques, the attacker can replace the freed object with controlled payload data.\nSubsequent access to the dangling pointer results in arbitrary code execution within the context of the renderer process or GPU process. To achieve a sandbox escape, the attacker leverages this arbitrary code execution primitive to exploit secondary vulnerabilities or kernel interfaces accessible from the compromised browser process, thereby breaking out of the Chromium sandbox and executing code with broader system privileges on the Android device.\nThe affected component is the WebGL subsystem in Google Chrome on Android versions prior to 151.0.7922.109. The attack vector is entirely network-based via web content, requiring no user interaction other than navigating to the malicious URL. No authentication or local system privileges are required by the attacker prior to exploitation."
}