CVE-2026-17808: Google Chrome WebGL Information Disclosure

CVE-2026-17808 Overview

CVE-2026-17808 is an uninitialized memory use vulnerability [CWE-457] in the WebGL component of Google Chrome on Android prior to version 151.0.7922.72. A remote attacker can exploit the flaw by serving a crafted HTML page, causing the browser to read uninitialized memory during WebGL processing. The result is a cross-origin data leak that bypasses the same-origin policy enforced by the browser.

Google's Chromium team rated this issue as Medium severity. Successful exploitation requires only that a target user visits an attacker-controlled or compromised web page rendering the malicious content.

Critical Impact
Remote attackers can leak cross-origin data from Chrome on Android users by luring them to a crafted HTML page that abuses uninitialized memory in WebGL.

Affected Products

Google Chrome on Android versions prior to 151.0.7922.72
WebGL rendering subsystem within the Chromium browser engine
Downstream Chromium-based Android browsers that share the vulnerable WebGL code path

Discovery Timeline

2026-07-30 - CVE-2026-17808 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17808

Vulnerability Analysis

The vulnerability resides in the WebGL implementation shipped with Chrome on Android. WebGL exposes GPU-accelerated rendering APIs to JavaScript running in the browser. A code path within this implementation uses a memory region before initializing it, causing rendering operations to consume undefined byte values.

Because WebGL surfaces can be read back through JavaScript via texture reads and pixel buffers, uninitialized bytes become observable to the attacking script. Those bytes may originate from prior allocations belonging to other origins or browser internals. This turns a memory-safety bug into a same-origin policy bypass.

The leaked contents are not attacker-chosen but are attacker-observable, which is sufficient to exfiltrate fragments of cross-origin responses, tokens, or other sensitive state processed by the renderer.

Root Cause

The root cause is classified under [CWE-457]: Use of Uninitialized Variable. A buffer or GPU-facing memory region within the WebGL pipeline is read before being written with defined data. Chromium fixed the defect in Chrome 151.0.7922.72 for Android.

Attack Vector

Exploitation is remote and requires user interaction limited to visiting a page. The attacker hosts a crafted HTML document containing JavaScript that instantiates WebGL contexts and issues the specific sequence of calls that triggers the uninitialized read. The script then reads back the rendered output and extracts residual memory contents to reconstruct cross-origin data.

See the Chromium Issue Discussion and the Google Chrome Stable Update for vendor references.

Detection Methods for CVE-2026-17808

Indicators of Compromise

Chrome for Android clients reporting version strings older than 151.0.7922.72 in HTTP User-Agent headers or telemetry
Outbound requests from mobile devices to newly registered domains hosting pages that aggressively initialize multiple WebGL contexts
Anomalous JavaScript payloads combining getContext('webgl'), repeated readPixels calls, and cross-origin <iframe> or <img> loads on the same page

Detection Strategies

Inventory managed Android devices for Chrome versions and flag any build below 151.0.7922.72 for upgrade
Inspect web proxy logs for pages that combine cross-origin resource loads with WebGL API usage patterns consistent with pixel readback exfiltration
Correlate DNS resolution of low-reputation domains with mobile browser sessions to surface likely delivery infrastructure

Monitoring Recommendations

Enable browser version reporting through mobile device management (MDM) and alert on out-of-date Chrome installations
Monitor for user reports of unexpected content rendering, session anomalies, or account activity following visits to unfamiliar sites
Track vendor advisories from the Chrome Releases blog to detect follow-on regressions or related WebGL fixes

How to Mitigate CVE-2026-17808

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Push a forced update policy through enterprise MDM for managed Android fleets to close the exposure window
Communicate the risk to users who handle sensitive data on mobile devices and require restart of the browser to apply the patch

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fix ships in Chrome 151.0.7922.72 on Android. Chromium-based downstream browsers should uptake the corresponding upstream patch referenced in the Chromium Issue Discussion.

Workarounds

Disable WebGL in Chrome on Android where feasible by restricting hardware acceleration via enterprise policy
Restrict browsing on high-value mobile accounts to allowlisted sites until the patched Chrome build is deployed
Use network-layer controls to block known malicious domains delivering crafted WebGL exploit pages

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 151.0.7922.72 or later
# versionName=151.0.7922.72