CVE-2026-91726: Google Chrome WebGL Information Disclosure

CVE-2026-91726 Overview

CVE-2026-91726 is an out-of-bounds read vulnerability [CWE-125] in the WebGL component of Google Chrome on Android. Versions prior to 153.0.8010.47 allow a remote attacker to read memory outside the browser sandbox through a crafted HTML page. Chromium project maintainers assigned this issue an internal severity rating of Critical, while the NVD scored it as Medium due to limited confidentiality impact and required user interaction.

Exploitation requires a victim to visit an attacker-controlled web page. Successful exploitation exposes adjacent process memory, which can leak sensitive data such as authentication tokens, session material, or memory addresses useful in chained exploits.

Critical Impact
A remote attacker can read memory outside the sandbox in Google Chrome on Android by luring a user to a crafted HTML page that abuses WebGL.

Affected Products

Google Chrome on Android prior to 153.0.8010.47
Google Android platforms running vulnerable Chrome builds
Chromium-based browsers on Android inheriting the affected WebGL code

Discovery Timeline

2026-09-15 - CVE-2026-91726 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91726

Vulnerability Analysis

The flaw resides in Chrome's WebGL implementation, which exposes GPU-accelerated graphics APIs to JavaScript running in web pages. WebGL processes complex binary data structures, buffer bindings, and shader inputs supplied by untrusted web content. When the renderer performs an operation without correctly validating a read boundary, it accesses memory beyond the intended buffer.

The read primitive discloses data from adjacent memory regions in the renderer process. An attacker can convert this leak into intelligence about heap layout, pointer values, or cached credentials. While the vulnerability does not directly grant code execution, it weakens sandbox assumptions and supports exploit chains that combine memory disclosure with a separate corruption bug.

Root Cause

The root cause is an out-of-bounds read [CWE-125] in WebGL command or buffer handling on the Android build of Chrome. Missing or incorrect bounds checks allow the code to index past the end of an allocated buffer. Chromium's security notes classify the underlying defect as Critical, indicating the read reaches memory outside the sandbox boundary rather than only within renderer-controlled memory.

Attack Vector

Exploitation is remote and requires user interaction. The victim must load an attacker-controlled or compromised HTML page in a vulnerable Chrome for Android build. The page issues crafted WebGL calls from JavaScript that trigger the boundary violation. No authentication is required, and the attacker changes the security scope by influencing content outside the renderer's isolation boundary.

The vulnerability is described in the Google Chrome Stable Channel Update and tracked in the Chromium Issue Tracker Entry. No public proof-of-concept or exploit code is currently listed in NVD references.

Detection Methods for CVE-2026-91726

Indicators of Compromise

Android devices running Chrome versions earlier than 153.0.8010.47 that have browsed untrusted or newly registered domains hosting WebGL content.
Renderer process crashes or unexpected GPU process terminations coinciding with visits to unfamiliar web pages.
Outbound connections from mobile endpoints to domains serving heavily obfuscated WebGL or shader payloads.

Detection Strategies

Inventory installed Chrome versions across managed Android fleets and flag builds below 153.0.8010.47.
Correlate web proxy or DNS telemetry with browsing sessions that precede renderer crash reports on mobile devices.
Hunt for repeated fetches of .html resources that reference WebGL contexts from low-reputation domains.

Monitoring Recommendations

Ingest Chrome and Android crash telemetry into a centralized data lake and alert on WebGL or GPU-process faults.
Monitor mobile device management (MDM) compliance status for Chrome update posture on Android endpoints.
Track browsing telemetry for repeated visits to domains categorized as newly observed or uncategorized.

How to Mitigate CVE-2026-91726

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.47 or later through the Google Play Store.
Push forced browser updates to managed Android devices using MDM policies.
Communicate the risk of clicking untrusted links to users of Android devices that cannot be updated immediately.

Patch Information

Google addressed the issue in the Chrome stable channel release documented in the Google Chrome Release Update. Users should install Chrome 153.0.8010.47 or later on Android. Chromium downstream projects should incorporate the corresponding upstream fix referenced in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted domains through MDM-enforced allowlists until the patched Chrome build is deployed.
Disable WebGL where feasible on high-risk devices by enforcing Chrome enterprise policies that block hardware-accelerated graphics.
Route mobile browsing through a secure web gateway that inspects and filters untrusted HTML and JavaScript content.

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName