Google Chrome CVE-2026-106239

Exploitation requires a victim running Google Chrome on Android at a version prior to 155.0.8059.39 to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path, triggering the CWE-190 integer overflow. WebGL is enabled by default, so no special configuration is needed, but the attack is gated by required user interaction (UI:R) - the user must navigate to the malicious page - and is limited to the Android platform and unpatched versions, which is why SSVC marks it Automatable: no. No authentication is required (PR:N).

This is a genuine high priority despite no confirmed exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 9.6) describes a network-reachable, low-complexity, unauthenticated flaw requiring only that a victim open a crafted page, with a scope change reflecting a sandbox escape and total loss of confidentiality, integrity, and availability - consistent with the description's 'execute arbitrary code outside the sandbox.' CISA SSVC reinforces this with Technical Impact: total, but also records Exploitation: none and Automatable: no, meaning no evidence of active exploitation and the attack is not mass-automatable because it hinges on luring users to malicious pages. This flaw is NOT in CISA KEV, and no POC is referenced in the provided data, so there is no EPSS score supplied to weigh. The signals are therefore consistent rather than conflicting: very high technical severity and easy reachability, but currently theoretical exploitation requiring user interaction. Treat as a prompt-patch item given Chrome's footprint and the browser-escape impact, while recognizing active, widespread exploitation is not currently evidenced.

An attacker hosts or compromises a web page containing malicious WebGL content and lures an Android Chrome user to visit it (e.g., via a link in a message or malicious ad). The crafted page triggers an integer overflow in Chrome's WebGL handling, enabling arbitrary code execution that escapes the renderer sandbox onto the device. No public exploit is identified at time of analysis, and user interaction (opening the page) is required.