CVE-2026-85050
CriticalCVSS 9.6Summary
Out of bounds write in WebGL in Google Chrome on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Risk Assessment
An attacker can execute arbitrary code on the victim's device outside the browser sandbox, potentially leading to full device and data compromise.
Recommendation
Immediately update Google Chrome on Android to version 152.0.7977.82 or later and avoid opening untrusted HTML pages.
Other vulnerabilities in Google Chrome
See all- CVE-2026-85053High
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85052Low
Google Chrome prior to version 152.0.7977.82 has an out-of-bounds read vulnerability in CrashReporting. A remote attacker who compromised the renderer process could read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85051High
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85049High
Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85048High
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85046High
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-85045High
A race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The severity is rated as High.
- CVE-2026-85044Unknown
Google Chrome on Android prior to version 152.0.7977.82 has a use-after-free vulnerability in the Mobile component. A remote attacker leveraging social engineering could bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- CVE-2026-85043Unknown
Google Chrome prior to version 152.0.7977.82 has an incomplete cleanup vulnerability in the Network component. A remote attacker could bypass system access restrictions via crafted network traffic. (Chromium security severity: High)
- CVE-2026-8581High
A use after free vulnerability in GPU in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Original NVD description (English source)
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)