CVE-2026-84352: Chrome WebGL Use-After-Free Vulnerability

CVE-2026-84352 Overview

CVE-2026-84352 is a use-after-free vulnerability in the WebGL component of Google Chrome on Android prior to version 152.0.7977.75. A remote attacker can execute arbitrary code outside the Chrome sandbox by convincing a user to visit a crafted HTML page. Google's Chromium project rated the underlying issue as Critical severity. The flaw is tracked under CWE-416: Use After Free and requires user interaction to trigger. Successful exploitation grants attackers code execution with the privileges of the browser process, bypassing the sandbox isolation designed to contain renderer compromises.

Critical Impact
Remote attackers can escape the Chrome Android sandbox and execute arbitrary code by luring users to a malicious web page rendering crafted WebGL content.

Affected Products

Google Chrome for Android versions prior to 152.0.7977.75
WebGL rendering component within the Chromium engine
Downstream Chromium-based Android browsers sharing the vulnerable WebGL code path

Discovery Timeline

2026-09-02 - CVE-2026-84352 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84352

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, the GPU-accelerated graphics API exposed to web content on Android. A use-after-free condition occurs when the WebGL subsystem references memory that has already been freed. Attackers who control the freed allocation's contents can hijack execution flow when the dangling pointer is dereferenced.

WebGL bugs are particularly damaging because the API bridges untrusted JavaScript to native GPU driver code. According to the vendor advisory, this flaw allows code execution outside the sandbox, meaning the attacker gains privileges beyond the constrained renderer process. On Android, this exposes device data, credentials, and other application contexts to compromise.

Root Cause

The root cause is improper object lifetime management in the WebGL code path. A GPU-related object is freed while other components retain references to it. Subsequent operations on that stale reference produce memory corruption. Google has not published implementation-level details in the referenced Chromium Issue Tracker #546260492 while user exposure remains high.

Attack Vector

Exploitation requires an attacker-controlled or attacker-influenced web page. The victim must load the page in a vulnerable Chrome for Android build. The crafted HTML delivers JavaScript that invokes specific WebGL calls in an order that triggers the use-after-free. Once memory is corrupted, the attacker pivots to arbitrary code execution outside the sandbox. Delivery typically occurs through phishing links, malvertising, or compromised sites. Refer to the Google Chrome Stable Update advisory for vendor guidance.

Detection Methods for CVE-2026-84352

Indicators of Compromise

Chrome for Android processes crashing with signals consistent with heap corruption after visiting untrusted sites
Unexpected child processes spawned by the Chrome package on Android endpoints
Outbound connections from mobile devices to known malvertising or exploit-kit infrastructure following browsing activity
HTML pages containing anomalous WebGL shader compilation and rapid context creation or destruction sequences

Detection Strategies

Inventory Chrome for Android versions across the mobile fleet and flag any build below 152.0.7977.75
Alert on Chrome renderer crash telemetry combined with post-crash process anomalies
Inspect web proxy logs for HTML resources delivering high-volume WebGL API calls from low-reputation domains

Monitoring Recommendations

Ingest mobile browser version telemetry into the security data lake for continuous exposure tracking
Correlate Chrome crash events with subsequent network egress to identify possible post-exploitation activity
Monitor threat intelligence feeds for public proof-of-concept code targeting Chromium WebGL use-after-free bugs

How to Mitigate CVE-2026-84352

Immediate Actions Required

Update Google Chrome for Android to version 152.0.7977.75 or later through the Google Play Store
Enforce mobile device management (MDM) policies that require current Chrome versions before permitting corporate resource access
Communicate the risk to users and warn against opening untrusted links on mobile devices until patched

Patch Information

Google released the fix in the Chrome stable channel update documented at the Chrome Releases blog. Users on Android must upgrade to Chrome 152.0.7977.75 or newer. Chromium-derived browsers should adopt the upstream patch referenced in Chromium Issue Tracker #546260492.

Workarounds

Use an alternative, up-to-date browser on Android until Chrome is upgraded on the device
Restrict browsing to trusted domains through mobile threat defense or DNS filtering
Disable JavaScript for untrusted sites through Chrome site settings to prevent WebGL invocation

bash

# Verify Chrome for Android version via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 152.0.7977.75 or higher