CVE-2026-95283 Overview
CVE-2026-95283 is a heap-based buffer overflow [CWE-122] in the Tint component of Google Chrome on Android. Tint is the WebGPU Shading Language (WGSL) compiler used by Chrome's GPU process. A remote attacker can trigger the flaw by convincing a user to visit a crafted HTML page. Successful exploitation may allow arbitrary code execution outside the browser sandbox. Google fixed the issue in Chrome for Android version 154.0.8037.57.
Critical Impact
Remote attackers can execute arbitrary code outside the Chrome sandbox on Android devices through a single crafted web page, bypassing a core browser isolation boundary.
Affected Products
- Google Chrome for Android prior to 154.0.8037.57
- Google Android devices running vulnerable Chrome builds
- Any Android application embedding the affected Chrome/Chromium WebGPU stack
Discovery Timeline
- 2026-09-29 - CVE-2026-95283 published to the National Vulnerability Database (NVD)
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-95283
Vulnerability Analysis
The flaw resides in Tint, the WGSL compiler that translates WebGPU shader source into backend representations for Chrome's GPU process. A crafted shader program delivered through a WebGPU-enabled HTML page causes Tint to write beyond the bounds of an allocated heap buffer. Because the GPU process handles input from the untrusted renderer and interacts with kernel-mode graphics drivers, memory corruption here provides an attractive path for attackers seeking to escape the Chrome sandbox.
Exploitation requires only that a user load an attacker-controlled page, which aligns with the network attack vector and user interaction requirement recorded for this CVE. Because the impact crosses the renderer/GPU trust boundary, the vulnerability carries a scope change and full confidentiality, integrity, and availability impact.
Root Cause
The root cause is a heap buffer overflow inside Tint's shader processing logic. The compiler fails to correctly bound a write operation against the size of an allocated heap region while handling attacker-controlled WGSL input. Chromium categorized the underlying issue as High severity in its internal tracker (issue #543141419). No further technical detail has been published while user updates roll out.
Attack Vector
An attacker hosts a malicious HTML page that submits a specially crafted WGSL shader through the WebGPU API. When a victim using a vulnerable Chrome for Android build visits the page, Tint parses or transforms the shader and overflows a heap buffer inside the GPU process. Chained with additional bugs, this corruption can be developed into arbitrary code execution outside the renderer sandbox. See the Chromium Issue Tracker entry and the Google Chrome Stable Update announcement for vendor context.
No verified public exploit code is available. Refer to the vendor advisory for technical details.
Detection Methods for CVE-2026-95283
Indicators of Compromise
- Unexpected crashes or restarts of the Chrome GPU process on Android devices, particularly when browsing WebGPU-enabled sites.
- Chrome for Android clients reporting versions earlier than 154.0.8037.57 in mobile device management (MDM) inventory.
- Outbound connections from mobile browser sessions to newly registered domains hosting WebGPU shader payloads.
Detection Strategies
- Inventory installed Chrome versions across managed Android fleets and flag any build older than 154.0.8037.57.
- Monitor mobile endpoint telemetry for repeated GPU process crash signatures correlated with browsing activity.
- Hunt web proxy and DNS logs for HTML pages that reference the WebGPU API (navigator.gpu) from low-reputation domains.
Monitoring Recommendations
- Enable centralized crash reporting from managed Android devices to surface anomalous Chrome renderer or GPU faults.
- Correlate browser version telemetry with threat intelligence feeds tracking Chromium security advisories.
- Alert on installations or sideloads of outdated Chrome APKs pushed outside sanctioned distribution channels.
How to Mitigate CVE-2026-95283
Immediate Actions Required
- Update Google Chrome for Android to version 154.0.8037.57 or later through the Google Play Store.
- Enforce minimum Chrome version policies via MDM and quarantine devices that cannot upgrade.
- Advise users to avoid untrusted links and unknown WebGPU-heavy sites until patching is confirmed.
Patch Information
Google released the fix in the Stable channel update documented in the Google Chrome Stable Update announcement. Users should confirm Chrome for Android reports version 154.0.8037.57 or newer under Settings > About Chrome.
Workarounds
- Disable WebGPU on managed Android browsers where feasible until the patched Chrome build is deployed.
- Restrict browsing on high-risk mobile devices to an allowlist of trusted domains through mobile web filtering.
- Use enterprise browser management to force automatic Chrome updates and block execution of outdated builds.
# Verify Chrome for Android package version on a managed device
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 154.0.8037.57 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
