# CVE-2026-102331: Google Chrome buffer overflow in ANGLE on Android

Source: https://junglewise.ai/threats/cve-2026-102331-buffer-overflow-in-angle-in-google-chrome-on-on-android-prior-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102331 · Severity: critical · CVSS 9.6 · Published 2026-09-29

Google Chrome on Android contains a buffer overflow vulnerability in the ANGLE graphics rendering component that allows a remote attacker to execute arbitrary code outside the browser's security sandbox by visiting a malicious website. This could lead to complete device compromise, data theft, and installation of malware without user awareness or ability to prevent it.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-102331 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102331 being exploited in the wild.

**How severe is CVE-2026-102331?** Critical severity, with a CVSS score of 9.6, published 29 September 2026.

**Which products and versions are affected?** Google Chrome prior to 154.0.8037.92 on Android.

**Is there a fix for CVE-2026-102331?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102331 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-102331?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow in ANGLE (the graphics abstraction layer used by Chrome) allows arbitrary code execution outside the sandbox via a crafted HTML page delivered over the network. The vulnerability affects Chrome on Android versions prior to 154.0.8037.92 and is exploited remotely without requiring user interaction beyond normal web browsing. Google has patched this critical issue in the September 2026 stable release.

## Affected products

- Google Chrome prior to 154.0.8037.92 on Android

## Timeline

- 2026-09-29: disclosed: Fixed in Chrome 154.0.8037.92 for Android

## References

- [https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01807488085.html)
- [https://issues.chromium.org/issues/551673541](https://issues.chromium.org/issues/551673541)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)