Description

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-03T20:17:26.077Z",
  "pubdate": "2026-09-03T20:17:26.077Z",
  "executiveSummary": "This vulnerability is an out-of-bounds write flaw identified within the WebGL implementation of Google Chrome on Android. It carries a Chromium security severity rating of High. The defect allows a remote attacker to achieve arbitrary code execution outside the browser's sandbox environment by leveraging a specifically crafted HTML page.\nThe vulnerability resides in the graphics processing pipeline, specifically within the WebGL component, which handles hardware-accelerated 2D and 3D graphics. By providing malicious input, an attacker can trigger a memory corruption condition that enables the execution of unauthorized code. This poses a significant threat to user data integrity and device security, as the breach of the browser sandbox permits the attacker to bypass fundamental isolation mechanisms intended to protect the operating system. No specialized authentication or user privileges are required for exploitation, as the attack is delivered via web content. Successful exploitation necessitates that a user visits a malicious page, potentially leading to full device compromise depending on the subsequent exploitation of further system-level flaws.",
  "technicalDetails": "The vulnerability is categorized as an out-of-bounds (OOB) write, occurring within the WebGL subsystem of Google Chrome on Android. WebGL provides an API for rendering interactive 3D and 2D graphics within any compatible web browser without the use of plug-ins. The root cause lies in improper bounds checking when processing graphics commands or buffer operations within the browser's GPU process.\nThe attack flow begins when a remote attacker hosts a crafted HTML page containing malicious WebGL shaders or buffer manipulation routines. When the target device accesses this page, the browser's rendering engine attempts to interpret the malicious instructions. Due to the lack of sufficient validation on indices or memory offsets during the interaction with the underlying graphics driver or memory buffers, the renderer writes data to a memory location outside the allocated destination buffer.\nBy carefully controlling the content and location of this out-of-bounds write, an attacker can corrupt adjacent memory structures. This memory corruption is often leveraged to overwrite function pointers, return addresses, or objects critical to the browser's execution flow. Once control over the instruction pointer is achieved, the attacker can redirect execution to an arbitrary payload, which may be delivered as part of the initial malicious page or fetched from an external source.\nThe impact is magnified by the ability to escape the browser sandbox. The sandbox is the primary security boundary that restricts a renderer process from accessing files, network resources, or system-level services directly. By bypassing this sandbox via an OOB write, the attacker transitions from executing code within the isolated renderer process to executing code with the privileges of the browser application or, through further exploit chains, the underlying Android operating system. The vulnerability affects Google Chrome on Android versions prior to 152.0.7977.82. The attack is network-exposed, requiring only that the victim navigate to the malicious URL. No local authentication is required, and the exploit is effectively triggered by the standard processing of web graphics content."
}