# CVE-2026-85050: Google Chrome out of bounds write in WebGL

Source: https://junglewise.ai/threats/cve-2026-85050-google-chrome-out-of-bounds-write-in-webgl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85050 · Severity: critical · CVSS 9.6 · Published 2026-09-03

Google Chrome's WebGL renderer on Android contains an out-of-bounds write vulnerability that allows an attacker to execute arbitrary code outside the browser's security sandbox. An attacker can exploit this by hosting a malicious website; victims who visit the site could have their device fully compromised with the attacker gaining the same permissions as the Chrome application.

Technologies: [Google Android](https://junglewise.ai/threats/technologies/android), [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-85050 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85050 being exploited in the wild.

**How severe is CVE-2026-85050?** Critical severity, with a CVSS score of 9.6, published 3 September 2026.

**Which products and versions are affected?** Google Chrome prior to 152.0.7977.82 on Android.

**Is there a fix for CVE-2026-85050?** A patch was published on 2026-09-03: Fixed in Chrome 152.0.7977.82 for Android Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85050 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85050?** Check whether you run Google Android or Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an out-of-bounds write in the WebGL component of Google Chrome on Android, classified as a memory safety issue. The vulnerability allows remote code execution outside the browser sandbox via a crafted HTML page—no user interaction beyond visiting a website is required. The root cause involves improper bounds checking in WebGL memory operations. The vulnerability was patched in Chrome version 152.0.7977.82 for Android and later versions. Google reported this issue on August 20, 2026, and actively exploited versions prior to 152.0.7977.82 are vulnerable.

## Affected products

- Google Chrome prior to 152.0.7977.82 on Android

## Timeline

- 2026-09-03: disclosed: CVE-2026-85050 disclosed by Google Chrome security team
- 2026-09-03: patched: Fixed in Chrome 152.0.7977.82 for Android

## References

- [https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html)
- [https://issues.chromium.org/issues/549350408](https://issues.chromium.org/issues/549350408)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)