EUVD-2026-50676
GHSA-q979-p6rc-5p76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage invokes malicious WebGL calls
-
ExploitTrigger out-of-bounds write in WebGL
-
ExecutionCorrupt renderer memory
-
PersistEscape Chrome sandbox
-
ImpactGain broader code execution on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively load an attacker-controlled HTML page in Google Chrome for Android prior to 151.0.7922.72, and that page must invoke the vulnerable WebGL code path - so WebGL/hardware-accelerated graphics must be usable in the renderer (the default). The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms no authentication is needed, but user interaction (visiting the malicious page) is mandatory, which is the key limiting factor. Exploitation is further constrained to the Android platform and to the 'potential' step of converting the WebGL memory corruption into an actual sandbox escape, which per SSVC is not automatable and has no confirmed public exploit. |
| Impact | The signals partly conflict and should be weighed carefully. CVSS 9.6 is driven by network reach (AV:N), low complexity (AC:L), no privileges (PR:N), scope change from sandbox escape (S:C) and total C/I/A impact - a genuinely severe technical profile, reinforced by SSVC 'Technical Impact: total'. However, real-world exploitation pressure appears modest: EPSS is only 0.21% (11th percentile), SSVC 'Exploitation: none' and 'Automatable: no', it is not in CISA KEV, and no public exploit is identified. The 'no' on automatable reflects the UI:R requirement (a user must visit a crafted page) and the difficulty of chaining a WebGL OOB write into a reliable sandbox escape. Net: high-impact-if-exploited but not currently under active or automated exploitation - patch promptly on Android fleets, but this is not evidence of mass exploitation. The word 'potentially' in the vendor description signals the sandbox escape is a plausible outcome of the memory corruption, not a demonstrated turnkey exploit. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page containing crafted WebGL/JavaScript and lures an Android Chrome user to visit it via a phishing link, malvertising, or a compromised site. Rendering the page triggers the out-of-bounds write in WebGL, corrupting renderer memory in an attempt to escape the sandbox and gain broader execution on the device. No public exploit is identified at time of analysis, and the attack is not automatable per SSVC, so reliability would require a bespoke exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.
RemediationAI
Vendor-released patch: update Google Chrome for Android to 151.0.7922.72 or later, as delivered through the Google Play Store stable channel per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Ensure automatic app updates are enabled on managed Android devices so the fixed build rolls out without user action, and verify the running version via chrome://version. If immediate patching is not possible, the primary compensating control is to disable WebGL by navigating to chrome://flags and turning off WebGL/hardware acceleration, or blocking the attack surface via enterprise policy - the trade-off is that WebGL-dependent sites (maps, 3D viewers, some games and dashboards) will fail to render. Additionally, restrict browsing to trusted sites and use content filtering to reduce exposure to crafted pages until the update is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in WebGL, the browser API that exposes GPU-accelerated 3D graphics (based on OpenGL ES) to JavaScript running inside a web page. WebGL processes untrusted geometry, shader, and buffer data in the renderer process, making it a historically rich source of memory-safety bugs. The root cause is classified as CWE-787 (Out-of-bounds Write), meaning attacker-controlled input drives a write past the bounds of an allocated buffer - corrupting adjacent memory. Because a successful corruption here is described as enabling a sandbox escape, the defect undermines the renderer sandbox boundary that normally confines compromised web content. The affected component is Google Chrome (CPE cpe:2.3:a:google:chrome), specifically the Android build prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page with no privileges but required user interaction (UI:R); sandbox escape breaks the renderer boundary (S:C) with full memory-corruption-driven C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) contains a memory corruption vulnerability (CVE-2026-17727) enabling remote code execution when users visit malicious websites. This threatens all mobile users with Android Chrome, as exploitation requires no authentication-only visiting a compromised page-making it a critical mobile security and data protection risk across your user base.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB