CVE-2026-87438: Google Chrome WebGL RCE Vulnerability

CVE-2026-87438 Overview

CVE-2026-87438 is an out-of-bounds write vulnerability in the WebGL component of Google Chrome on Android. Versions prior to 153.0.8010.36 are affected. A remote attacker can execute arbitrary code outside the Chrome sandbox by luring a user to a crafted HTML page. Google's Chromium project rates the underlying issue as Critical severity. The flaw maps to CWE-787: Out-of-bounds Write and requires user interaction to open or render attacker-controlled content.

Critical Impact

Successful exploitation allows arbitrary code execution outside the browser sandbox on Android devices, breaking the primary containment boundary that isolates web content from the underlying operating system.

Affected Products

• Google Chrome for Android prior to 153.0.8010.36
• Google Android devices running vulnerable Chrome builds
• Chromium-based components relying on the affected WebGL code path

Discovery Timeline

• 2026-09-09 - CVE-2026-87438 published to the National Vulnerability Database
• 2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87438

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, the browser subsystem that exposes hardware-accelerated 3D graphics to JavaScript. An out-of-bounds write occurs when the renderer writes data past the intended buffer boundary during WebGL processing. On Android, successful exploitation enables code execution outside the sandbox, meaning attacker code can run with the privileges of the browser process rather than being confined to the renderer.

Because the attack vector is a crafted HTML page, exploitation only requires that a user visit a malicious or compromised site. No credentials or prior access are needed. The scope change indicates the impact extends beyond the initially compromised component, consistent with a sandbox escape.

Root Cause

The root cause is an out-of-bounds write [CWE-787] inside WebGL. Memory safety errors in graphics pipelines typically stem from insufficient validation of buffer sizes, indices, or parameters passed from JavaScript into native GPU-facing code. Refer to Chromium Issue #548127218 for tracking details.

Attack Vector

A remote attacker hosts a crafted HTML page containing malicious WebGL content. When a user on a vulnerable Chrome for Android build loads the page, the WebGL code path triggers the out-of-bounds write. The attacker can then chain memory corruption primitives to gain arbitrary code execution outside the Chrome sandbox on the Android device.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87438

Indicators of Compromise

• Chrome for Android renderer or browser process crashes with signatures pointing to WebGL, GPU, or graphics libraries
• Unexpected outbound network connections initiated by Chrome shortly after visiting an untrusted site
• Installation of unknown APKs or spawning of unexpected child processes following browser activity

Detection Strategies

• Inventory Chrome for Android versions across managed devices and flag any build below 153.0.8010.36
• Monitor mobile threat telemetry for anomalous WebGL usage patterns or repeated renderer crashes tied to specific URLs
• Correlate web proxy logs with threat intelligence feeds to identify traffic to hosts serving crafted HTML pages targeting Chromium WebGL bugs

Monitoring Recommendations

• Enable mobile device management (MDM) reporting on Chrome version compliance
• Ingest browser and mobile telemetry into a centralized data lake for retrospective hunting against Chromium CVE indicators
• Alert on newly observed domains referenced by Chrome sessions immediately preceding crash or privilege-anomaly events

How to Mitigate CVE-2026-87438

Immediate Actions Required

• Update Google Chrome for Android to version 153.0.8010.36 or later through the Google Play Store
• Enforce Chrome auto-updates via MDM policy on all managed Android devices
• Communicate the risk to end users and instruct them to avoid untrusted links until patched

Patch Information

Google addressed the issue in the Chrome stable channel update referenced in the Google Chrome Stable Update advisory. Upgrading Chrome for Android to 153.0.8010.36 or later remediates the vulnerability. Tracking details are available in Chromium Issue #548127218.

Workarounds

• Restrict browsing to trusted sites on unpatched devices until the update is applied
• Use MDM policies to temporarily disable WebGL or block untrusted web content on high-risk devices
• Deploy DNS or web filtering to reduce exposure to malicious HTML pages targeting Chromium

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Force Chrome update through Google Play (device with Play services)
adb shell am start -a android.intent.action.VIEW \
  -d "market://details?id=com.android.chrome"