Description
Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-09-29
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An out‑of‑bounds write occurs in the WebGL implementation of Google Chrome on Android. A remote attacker can embed a crafted HTML page that, when rendered, may lead to arbitrary code execution outside Chrome’s sandbox. The flaw is a classic memory corruption vulnerability (CWE‑787) and is considered critical.

Affected Systems

Google Chrome on Android devices running versions older than 154.0.8037.57 are vulnerable.

Risk and Exploitability

The CVSS score of 9.6 classifies the flaw as critical. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a malicious web page accessed over the network; the attacker would need only to entice the user to view the crafted content to trigger the exploit.

Generated by OpenCVE AI on September 30, 2026 at 00:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 154.0.8037.57 or later.
  • Disable WebGL rendering by using the --disable-webgl flag or setting the WebGL option to off in chrome://flags, as a temporary mitigation while the patch is deployed.
  • Apply all Google security updates promptly and monitor official advisories for additional measures.

Generated by OpenCVE AI on September 30, 2026 at 00:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 01 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write in WebGL Allows Remote Code Execution on Android Chrome chromium-browser: chromium-browser: Out of bounds write in WebGL
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 30 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 30 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Write in WebGL Allows Remote Code Execution on Android Chrome

Tue, 29 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-787
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-30T03:55:56.443Z

Reserved: 2026-09-22T05:09:12.414Z

Link: CVE-2026-95329

cve-icon Vulnrichment

Updated: 2026-09-29T18:06:55.579Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:25.330

Modified: 2026-09-30T14:59:03.010

Link: CVE-2026-95329

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-29T17:31:37Z

Links: CVE-2026-95329 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T00:45:17Z

Weaknesses