Description

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-02T00:18:29.097Z",
  "pubdate": "2026-09-02T00:18:29.097Z",
  "executiveSummary": "This vulnerability is a critical use-after-free (UAF) flaw located within the WebGL implementation of Google Chrome on Android. The vulnerability permits a remote attacker to bypass the browser sandbox, leading to arbitrary code execution on the underlying device.\nThe flaw stems from improper memory management, specifically memory safety violations during the lifecycle of WebGL objects. By delivering a specially crafted HTML page, a remote attacker can trigger a state where memory is accessed after it has been freed, enabling potential control over the instruction pointer or data structures in process memory.\nAffected systems include Google Chrome on Android versions prior to 152.0.7977.75. Given the potential for sandbox escape and remote code execution, the risk is classified as critical. Successful exploitation requires the user to interact with malicious web content, which triggers the UAF condition within the browser process. There is no requirement for local authentication or elevated privileges, making this an attractive target for remote exploitation campaigns aimed at total device compromise.",
  "technicalDetails": "The root cause of this vulnerability is a use-after-free defect in the WebGL component of the Chromium rendering engine. In memory-unsafe C++ environments, a UAF occurs when an object is deallocated but a reference (pointer) to that memory address persists and is subsequently dereferenced.\nThe exploitation flow typically begins with an attacker hosting a malicious HTML/JavaScript page. When this page is rendered, the attacker leverages WebGL API calls to create complex object lifecycles. By triggering specific garbage collection sequences or unexpected object destruction—often through deliberate race conditions or resource pressure—the attacker forces the browser to free memory currently held by a WebGL resource while a dangling pointer remains active in another part of the engine.\nOnce the dangling pointer is established, the attacker performs heap spraying or memory grooming to occupy the freed memory slot with controlled data. When the browser subsequently dereferences the dangling pointer, it processes the attacker's injected data as if it were a legitimate object. This can be used to overwrite function pointers or virtual method tables (vtable), redirecting the execution flow of the browser process.\nBecause the vulnerability exists in the context of the renderer or GPU process, the exploitation facilitates a sandbox escape. By chaining this primitive with a secondary exploit targeting kernel-level interfaces or system services, an attacker can transition from arbitrary code execution within the browser's constrained environment to full execution context at the OS level.\nThe attack is remotely executable, requiring only that the victim navigates to the malicious resource. There are no authentication or privilege requirements to trigger the memory corruption, as the vulnerability is triggered during standard page parsing and rendering. Post-exploitation, the attacker gains the ability to execute arbitrary code with the permissions of the browser application, which may include access to sensitive user data, microphone/camera access, or persistence mechanisms on the Android device."
}