Description
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-09-01
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution outside the sandbox
Action: Patch
AI Analysis

Impact

This vulnerability arises from a use‑after‑free bug in the WebGL implementation of Chrome on Android. A crafted HTML page can trigger a memory corruption that allows an attacker to execute arbitrary code with privileges that exceed the browser’s sandbox. The impact is remote code execution that can compromise the device, exfiltrate data, or enable further attacks.

Affected Systems

Google Chrome versions on Android lower than 152.0.7977.75 are vulnerable. The issue affects all Android devices running these Chrome versions, regardless of device manufacturer or OS build, until the security patch is applied.

Risk and Exploitability

The CVSS score of 9.6 indicates a critical severity, aligning with the Chromium severity rating of Critical, indicating a high‑consequence risk. EPSS data is unavailable and the vulnerability is not currently listed in the CISA KEV catalog, which does not imply low risk. The likely attack vector is a remote attacker delivering a malicious HTML page that the victim unknowingly opens. Successful exploitation requires the victim to view the page, and the code runs with elevated privileges outside the browser sandbox.

Generated by OpenCVE AI on September 2, 2026 at 13:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome on Android to version 152.0.7977.75 or newer, which contains the WebGL memory‑corruption fix.
  • Until the update is available, disable WebGL by navigating to chrome://flags, searching for “WebGL,” and setting the relevant flags to "Disabled" or launching Chrome with the "--disable-webgl" command line option.
  • Monitor for suspicious or phishing sites and keep other security updates applied; limit exposure to untrusted content.

Generated by OpenCVE AI on September 2, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Tue, 08 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 02 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
Title Use‑after‑Free in WebGL Enables Remote Code Execution Outside Sandbox

Wed, 02 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Title Use‑after‑Free in WebGL Enables Remote Code Execution Outside Sandbox

Wed, 02 Sep 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 02 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Description Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-416
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-03T03:55:43.397Z

Reserved: 2026-09-01T16:21:19.249Z

Link: CVE-2026-84352

cve-icon Vulnrichment

Updated: 2026-09-02T09:58:23.457Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-02T00:18:29.097

Modified: 2026-09-08T17:46:26.977

Link: CVE-2026-84352

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T14:00:09Z

Weaknesses