Buffer overflow in WebGL in Google Chrome on Android prior to 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The issue is a use‑after‑free memory safety flaw identified as CWE‑122. An attacker can trigger it without any user interaction by serving a malicious web page, potentially compromising the device by running code beyond Chrome’s sandbox.

Google Chrome for Android, any version older than 156.0.8078.47 is vulnerable; newer releases contain the patch that frees the memory correctly before use.

With a CVSS score of 8.8, this vulnerability is classified as High severity. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation. It is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation to date. Nonetheless, the remote nature of the flaw and the lack of user interaction mean that a malicious web page could compromise affected browsers, elevating the risk for all users of the vulnerable Android Chrome versions.