Executive brief
Google Chrome's WebGL graphics engine on Android contains an out-of-bounds memory read vulnerability that allows attackers to read sensitive data outside the browser's security sandbox. An attacker can exploit this by hosting a specially crafted HTML page and tricking a user into visiting it, potentially exposing passwords, authentication tokens, or other sensitive information stored in memory.
Technical details
The vulnerability is an out-of-bounds read in WebGL, Google Chrome's graphics API implementation on Android. It allows a remote attacker to read memory outside the browser's sandbox boundary by crafting a malicious HTML page. The attack is triggered when a user visits the attacker's page in Chrome; no additional user interaction or authentication is required beyond visiting the page. An attacker can extract sensitive data from memory that would normally be protected by the sandbox. The vulnerability was patched in Chrome 153.0.8010.47 for Android.
Affected products
- Google Chrome prior to 153.0.8010.47 on Android
Timeline
- 2026-09-15: disclosed: CVE-2026-91726 published
- 2026-09-15: patched: Patch released in Chrome 153.0.8010.47