Executive brief
A security vulnerability exists in the WebGL component of Google Chrome on Android. This component is responsible for rendering 3D graphics within the browser. An attacker could exploit this flaw by tricking a user into visiting a specially crafted website, potentially allowing the attacker to steal sensitive data from other websites the user has open.
Technical details
A vulnerability classified as an 'inappropriate implementation' exists in the WebGL component of Google Chrome for Android. The flaw allows for a cross-origin data leak, which occurs when the browser fails to properly isolate data between different website origins. A remote attacker can exploit this by hosting a malicious HTML page; when a user visits this page, the attacker can bypass Same-Origin Policy (SOP) protections to access data from other domains. This issue was addressed in Chrome version 148.0.7778.216. While the specific root cause is not detailed in the advisory, it is categorized by Chromium as High severity.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released
- 2026-05-28: disclosed: CVE published to NVD