EUVD-2026-50675
GHSA-w7ph-97wc-q2jr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryServe malicious WebGL JavaScript
-
ExploitTrigger integer overflow in WebGL
-
ExecutionCorrupt renderer memory
-
PersistEscape Chrome sandbox
-
ImpactGain elevated access on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML/WebGL page in a vulnerable Google Chrome for Android build (< 151.0.7922.72), so user interaction is mandatory (CVSS UI:R) - there is no zero-click path. The specific trigger is malicious WebGL content that drives the integer overflow; WebGL must be usable (it is enabled by default), meaning environments that disable WebGL or hardware acceleration are not exposed. No authentication is required (PR:N, unauthenticated remote attacker), but the attacker cannot proceed without luring the user to attacker-controlled content, and the flaw is described as only 'potentially' achieving sandbox escape, which limits reliable weaponization. |
| Impact | The signals are mixed and should be weighed together rather than trusting the headline 9.6. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) is high largely because of the scope change (S:C, reflecting sandbox escape) and full impact, but it requires user interaction (UI:R) to visit a crafted page. Countering the high CVSS, EPSS is only 0.21% (11th percentile), CISA SSVC reports Exploitation: none and Automatable: no, and there is no public exploit identified - so this is not a case of imminent mass exploitation. However, SSVC Technical Impact: total confirms the potential severity if weaponized. Google labels the bug 'potentially perform a sandbox escape,' which is a hedged claim indicating exploitability was demonstrated as plausible but perhaps not fully chained. Net: patch promptly given the total technical impact and browser ubiquity, but current real-world exploitation risk is low, likely favoring targeted rather than opportunistic use if it ever materializes. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/JavaScript that triggers the integer overflow, then lures an Android Chrome user to it via phishing, a malicious ad, or a compromised site. When the victim opens the page (UI:R), the overflow corrupts memory and is chained toward a sandbox escape, potentially giving the attacker code execution beyond the renderer. No public exploit is identified at time of analysis, so this remains a plausible but currently theoretical chain. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.
RemediationAI
Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome on Android to 151.0.7922.72 or later via the Play Store, and ensure desktop/other channels are on the corresponding Stable update per Google's advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates for most users, so verify the version in Settings > About and restart the browser to apply a pending update. If patching is delayed, the practical compensating control is to reduce exposure to untrusted WebGL content: disabling hardware acceleration or WebGL (via chrome://flags / enterprise policy) shrinks the attack surface but breaks GPU-accelerated sites and 3D content, and enterprise fleet management (Chrome Browser Cloud Management) can force the update to close the window quickly. There is no need to change ports or endpoints - this is a client-side browser flaw remediated purely by upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in WebGL, the browser API that exposes GPU-accelerated 2D/3D rendering (based on OpenGL ES) to untrusted JavaScript inside the renderer process. The root cause is CWE-190 (Integer Overflow or Wraparound): a size, index, or length calculation in WebGL wraps around its integer bounds, which typically leads to undersized buffer allocation and subsequent out-of-bounds memory access - consistent with the 'Buffer Overflow' and 'Integer Overflow' tags. Because WebGL bridges the sandboxed renderer and lower-level GPU/graphics handling, a memory-corruption primitive here can be leveraged toward a sandbox escape rather than mere renderer compromise. Per the CPE (cpe:2.3:a:google:chrome), the affected product is the Chrome application, specifically the Android build below 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote, unauthenticated, but needs the victim to visit a page (UI:R) and reliable sandbox-escape chaining of an integer overflow raises complexity (AC:H); sandbox escape justifies S:C with full impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for Android versions before 151.0.7922.72 contain a critical sandbox escape vulnerability that could allow attackers to gain unauthorized access to mobile devices if users visit a malicious webpage. All Android users running affected Chrome versions face direct risk of device compromise and data exposure. Leadership should prioritize this update given the high severity rating and full scope expansion beyond normal browser isolation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB