Description

Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-09T01:17:00.027Z",
  "pubdate": "2026-09-09T01:17:00.027Z",
  "executiveSummary": "A critical out-of-bounds (OOB) write vulnerability exists within the WebGL implementation of Google Chrome on Android. This security flaw allows a remote attacker to execute arbitrary code outside the browser sandbox environment.\nThe vulnerability is classified as critical due to its potential for full system compromise, as successful exploitation enables an attacker to bypass the browser's security boundary and execute malicious payloads on the underlying Android operating system.\nAffected products include versions of Google Chrome on Android prior to 153.0.8010.36. The flaw can be triggered by a remote attacker through a crafted HTML page, requiring no specialized user interaction beyond navigating the victim to a malicious site.\nGiven the nature of OOB memory corruption, this vulnerability poses a severe risk to data confidentiality, integrity, and availability, effectively neutralizing the sandboxing mechanisms intended to protect the host device from malicious web content.",
  "technicalDetails": "The vulnerability is rooted in an out-of-bounds (OOB) write condition within the WebGL component of the Chromium browser engine. WebGL, which provides an API for rendering 2D and 3D graphics, relies on the GPU process to handle complex shader programs and buffer operations. The flaw occurs when the engine fails to perform adequate bounds checking on memory operations initiated through WebGL commands, leading to unauthorized write access to memory segments located outside the intended buffers.\nExploitation is achieved by delivering a specifically crafted HTML page to the target device. When the victim accesses this page, the embedded JavaScript and WebGL commands interact with the browser's graphics rendering pipeline. By manipulating the state of the WebGL context—specifically through the creation of malformed textures or buffer objects—an attacker can induce the graphics driver or the browser's internal memory management to write data into memory regions controlled or accessible by the attacker.\nThe attack flow follows a structured path: First, the attacker embeds malicious WebGL calls within an HTML document. Upon execution, the browser allocates insufficient memory or fails to validate the offset parameters passed to internal graphics functions. Second, the OOB write is triggered during the rendering process, allowing the attacker to corrupt adjacent memory segments, such as metadata, function pointers, or objects within the heap.\nBy systematically overwriting critical data structures, the attacker can hijack the control flow of the browser process. In advanced scenarios, this corruption facilitates a sandbox escape, as the attacker achieves arbitrary code execution outside the isolated Chromium renderer process. Once control flow is hijacked, the payload can leverage the privileges associated with the browser application to execute commands, exfiltrate local data, or install persistent threats on the Android device.\nThe vulnerability affects Chromium prior to version 153.0.8010.36. There are no authentication requirements for an attacker; the exploit is purely remote and relies on the browser's capability to process untrusted web content. The primary component involved is the WebGL subsystem, specifically the memory management functions handling GPU-bound resources. The impact is catastrophic, as it effectively bypasses the multi-process architecture and sandboxing policies enforced by the browser, granting the attacker a foothold that can be leveraged for further system-level compromise."
}