Is CVE-2026-85050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85050 being exploited in the wild.

How severe is CVE-2026-85050?

Critical severity, with a CVSS score of 9.6, published 3 September 2026.

Which products and versions are affected?

Google Chrome prior to 152.0.7977.82 on Android.

Is there a fix for CVE-2026-85050?

A patch was published on 2026-09-03: Fixed in Chrome 152.0.7977.82 for Android Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85050 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85050?

Check whether you run Google Android or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85050: Google Chrome out of bounds write in WebGL

CVE-2026-85050 · Severity: critical · CVSS 9.6 · Published 2026-09-03

Google Chrome's WebGL renderer on Android contains an out-of-bounds write vulnerability that allows an attacker to execute arbitrary code outside the browser's security sandbox. An attacker can exploit this by hosting a malicious website; victims who visit the site could have their device fully compromised with the attacker gaining the same permissions as the Chrome application.

Technologies: Google Android, Google Chrome. Vendors: Google.

Quick answers

Is CVE-2026-85050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85050 being exploited in the wild.
How severe is CVE-2026-85050?: Critical severity, with a CVSS score of 9.6, published 3 September 2026.
Which products and versions are affected?: Google Chrome prior to 152.0.7977.82 on Android.
Is there a fix for CVE-2026-85050?: A patch was published on 2026-09-03: Fixed in Chrome 152.0.7977.82 for Android Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85050 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85050?: Check whether you run Google Android or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an out-of-bounds write in the WebGL component of Google Chrome on Android, classified as a memory safety issue. The vulnerability allows remote code execution outside the browser sandbox via a crafted HTML page—no user interaction beyond visiting a website is required. The root cause involves improper bounds checking in WebGL memory operations. The vulnerability was patched in Chrome version 152.0.7977.82 for Android and later versions. Google reported this issue on August 20, 2026, and actively exploited versions prior to 152.0.7977.82 are vulnerable.

Affected products

Google Chrome prior to 152.0.7977.82 on Android

Timeline

2026-09-03: disclosed: CVE-2026-85050 disclosed by Google Chrome security team
2026-09-03: patched: Fixed in Chrome 152.0.7977.82 for Android

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.