CVE-2026-95329: Google Chrome WebGL RCE Vulnerability

CVE-2026-95329 Overview

CVE-2026-95329 is an out-of-bounds write vulnerability [CWE-787] in the WebGL component of Google Chrome on Android. The flaw affects Chrome versions prior to 154.0.8037.57 and is tracked as Critical severity by the Chromium project. A remote attacker who convinces a user to load a crafted HTML page can trigger the condition and potentially execute arbitrary code outside the browser sandbox. Because WebGL processes attacker-controlled graphics data in a privileged rendering path, successful exploitation can grant code execution with the privileges of the compromised process on the Android device.

Critical Impact
Remote attackers can potentially execute arbitrary code outside the Chrome sandbox on Android devices by serving a crafted HTML page to a victim.

Affected Products

Google Chrome for Android prior to 154.0.8037.57
Google Android platforms running vulnerable Chrome builds
Chromium-based components relying on the affected WebGL code path

Discovery Timeline

2026-09-29 - CVE-2026-95329 published to the National Vulnerability Database
2026-09-30 - Last updated in the NVD database

Technical Details for CVE-2026-95329

Vulnerability Analysis

The vulnerability resides in Chrome's WebGL implementation, which exposes GPU-accelerated 3D rendering to JavaScript running in web pages. WebGL parses buffers, textures, and shader inputs from untrusted content, and any boundary error in this pipeline can corrupt adjacent memory. An out-of-bounds write allows an attacker to overwrite process memory beyond the intended allocation, enabling manipulation of function pointers, virtual tables, or object metadata. On Android, exploitation can lead to code execution outside the renderer sandbox, meaning the attacker can escape the isolation boundary that normally contains compromised web content. User interaction is required, but only to the extent of visiting a malicious page.

Root Cause

The root cause is an improper bounds check within the WebGL implementation. When crafted graphics parameters are processed, the code writes past the end of a memory buffer. This class of defect is tracked under [CWE-787: Out-of-bounds Write] and is a common precursor to memory corruption exploits in browser engines.

Attack Vector

Exploitation occurs over the network. An attacker hosts a crafted HTML page that issues specific WebGL calls, and the victim triggers the vulnerability by loading the page in a vulnerable Chrome build on Android. The scope is changed, indicating the impact crosses trust boundaries such as the renderer sandbox. Successful exploitation grants attacker-controlled code execution in a higher-privileged context than the compromised renderer.

No public proof-of-concept has been released. See the Chromium Issue Tracker entry for technical references.

Detection Methods for CVE-2026-95329

Indicators of Compromise

Unexpected Chrome renderer or GPU process crashes on Android devices, especially with signals consistent with memory corruption in WebGL code paths.
Chrome child processes spawning unexpected shells, downloading payloads, or making outbound connections to unfamiliar infrastructure shortly after web browsing activity.
Web traffic to pages containing anomalous WebGL shader or buffer payloads sized to trigger boundary conditions.

Detection Strategies

Inventory managed Android devices and identify Chrome installations at versions below 154.0.8037.57.
Monitor endpoint telemetry for Chrome process crashes correlated with WebGL activity or GPU driver faults.
Hunt for post-exploitation behaviors originating from Chrome child processes, including unusual file writes, persistence attempts, or lateral movement traffic.

Monitoring Recommendations

Ingest mobile browser crash telemetry and correlate with URL browsing history to identify targeted delivery attempts.
Alert on Chrome update compliance drift across the managed Android fleet.
Track outbound connections from mobile devices to newly registered or low-reputation domains hosting HTML content with WebGL payloads.

How to Mitigate CVE-2026-95329

Immediate Actions Required

Upgrade Google Chrome on Android to version 154.0.8037.57 or later on all managed devices.
Push forced updates through mobile device management to accelerate patch adoption across the fleet.
Communicate the risk to end users and instruct them to avoid untrusted links until patching completes.

Patch Information

Google addressed the flaw in the Chrome Stable Channel release documented in the Chrome Releases update. Verify installed versions are at 154.0.8037.57 or later. Additional technical context is available in the Chromium Issue Tracker entry.

Workarounds

Restrict browsing to trusted sites on unpatched Android devices until the update is applied.
Where policy permits, disable WebGL through enterprise Chrome policy on Android as a temporary control.
Use network filtering to block access to known malicious domains delivering crafted HTML content.

bash

# Example Chrome enterprise policy to disable WebGL as a temporary workaround
# Apply via Android Chrome managed configuration
{
  "WebGLEnabled": {
    "value": false
  }
}