EUVD-2026-69729
GHSA-3v6g-c22q-24w7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted WebGL page
-
DeliveryTrigger use-after-free in WebGL/GPU code
-
ExploitReclaim freed object to control memory
-
ExecutionAchieve code execution and escape sandbox
-
ImpactRun arbitrary code on Android device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled HTML containing malicious WebGL content in Chrome for Android before 152.0.7977.75 (UI:R - the user must open the page); WebGL/GPU rendering must be reachable, which it is in the default Chrome configuration. No authentication and no pre-existing privileges are needed (PR:N). Limiting factors: it only affects the Android build below the fixed version, needs user interaction to visit the page, and full impact depends on the renderer-sandbox-escape portion of the chain succeeding on the target device/GPU stack. |
| Impact | Multiple signals converge on high real-world priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects network reach, low complexity, no privileges, only requiring the victim to open a page, plus a sandbox escape (S:C) yielding full C/I/A impact. Chromium's internal 'Critical' rating is reserved for the most severe memory-corruption bugs, and WebGL UAFs are a historically favored, reliably exploitable target class. The only meaningful brake is UI:R - a user must visit attacker-controlled content - so this is drive-by/watering-hole territory rather than wormable server compromise. EPSS and CISA KEV status are not present in the provided data, so exploitation probability and confirmed active exploitation cannot be asserted; treat the absence as unknown, not as evidence of low risk. Given the near-ubiquity of Chrome on Android and the sandbox-escape impact, any organization managing Android fleets should treat this as urgent and push the update immediately. |
| Exploit ScenarioDerived | An attacker hosts or compromises a website and embeds a crafted WebGL page; when an Android user browsing with a pre-152.0.7977.75 Chrome opens it (via phishing link, malvertising, or watering-hole), the WebGL use-after-free is triggered and, after escaping the renderer sandbox, arbitrary code runs on the device. No public exploit is identified at time of analysis, but the bug class is reliably weaponizable and the low attack complexity makes exploitation practical once a technique is developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in the WebGL implementation, letting a remote attacker who lures a victim to a crafted HTML page execute arbitrary code OUTSIDE the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 (scope-changed) vector; a vendor patch shipped in the September 2026 Stable channel update. No public exploit identified at time of analysis, though the tracker bug (issues.chromium.org/546260492) and Google's own reporting indicate the flaw is well characterized.
RemediationAI
Vendor-released patch: update Google Chrome for Android to 152.0.7977.75 or later via the Google Play Store (or the enterprise-managed update channel). On managed Android fleets, use MDM/EMM policy to force the Chrome app update and verify the installed version. There is no supported configuration-level workaround for a memory-corruption bug of this kind; as an interim compensating control you can disable WebGL by navigating to chrome://flags and disabling WebGL-related flags or deploying the enterprise policy to restrict hardware-accelerated/WebGL content, which reduces the attack surface but will break 3D/graphics-heavy web apps and games. Restricting browsing to trusted sites via policy also lowers drive-by exposure at the cost of usability. Refer to Google's advisory (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html) for the authoritative fixed build.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-416 (Use After Free) in Chrome's WebGL subsystem - the JavaScript-accessible binding to GPU rendering (typically backed by ANGLE translating GL calls to the platform graphics API). WebGL processes attacker-controlled shader/buffer/context state in the renderer process, and a dangling pointer to a freed GPU/context object can be reclaimed and reused, giving an attacker control over freed memory. Critically, the description states code executes 'outside the sandbox,' implying the UAF is either in a GPU/browser-privileged path or is chained to escape the renderer sandbox, which aligns with the CVSS Scope:Changed (S:C) metric. The CPE-equivalent affected product per ENISA EUVD is Chrome on Android at versions below 152.0.7977.75.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N/AC:L/PR:N), victim must open it (UI:R), renderer-sandbox escape gives Scope:Changed with full RCE impact (C:H/I:H/A:H).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Executive ViewAI
Google Chrome for Android versions before 152.0.7977.75 contain a critical remote code execution vulnerability with sandbox escape capabilities that allow attackers to compromise mobile devices through malicious webpages. This directly threatens all employees using Chrome on Android for corporate access, enabling full device takeover and unauthorized access to sensitive company data. Organizations must prioritize immediate remediation to prevent mobile device compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 152 Memory Safety and Authorization Flaws
View all 26Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB