Executive brief
Google Chrome's WebGL renderer on Android contains an out-of-bounds write vulnerability that allows an attacker to execute arbitrary code outside the browser's security sandbox. An attacker can exploit this by hosting a malicious website; victims who visit the site could have their device fully compromised with the attacker gaining the same permissions as the Chrome application.
Technical details
This vulnerability is an out-of-bounds write in the WebGL component of Google Chrome on Android, classified as a memory safety issue. The vulnerability allows remote code execution outside the browser sandbox via a crafted HTML page—no user interaction beyond visiting a website is required. The root cause involves improper bounds checking in WebGL memory operations. The vulnerability was patched in Chrome version 152.0.7977.82 for Android and later versions. Google reported this issue on August 20, 2026, and actively exploited versions prior to 152.0.7977.82 are vulnerable.
Affected products
- Google Chrome prior to 152.0.7977.82 on Android
Timeline
- 2026-09-03: disclosed: CVE-2026-85050 disclosed by Google Chrome security team
- 2026-09-03: patched: Fixed in Chrome 152.0.7977.82 for Android