Executive brief
Google Chrome contains an out-of-bounds read vulnerability in its WebGL graphics component that allows remote attackers to execute arbitrary code outside the browser sandbox by tricking users into visiting a crafted webpage. This bypasses Chrome's core security boundary and could enable attackers to compromise an entire system or steal sensitive data with full system access.
Technical details
The vulnerability is an out-of-bounds read in WebGL, a graphics rendering API used by Chrome. The root cause exists in the WebGL component prior to version 153.0.8010.36. An attacker can craft a malicious HTML page that triggers the out-of-bounds memory access, allowing code execution outside the sandbox boundary. The attack vector is network-based and requires only user interaction (visiting a malicious webpage); no prior authentication is needed. Exploitation allows arbitrary code execution with the privileges of the Chrome process, potentially compromising the entire system. The fix is available in Chrome 153.0.8010.36 and later.
Affected products
- Google Chrome prior to 153.0.8010.36
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released