CVE-2026-95349: Google Chrome WebGL Buffer Overflow Vulnerability

CVE-2026-95349 Overview

CVE-2026-95349 is a heap buffer overflow [CWE-122] in the WebGL component of Google Chrome on Android. The flaw affects versions prior to 154.0.8037.57. A remote attacker can exploit the vulnerability by convincing a user to visit a crafted HTML page. Successful exploitation allows arbitrary code execution outside the Chrome sandbox. Google classifies the Chromium security severity as Critical.

Critical Impact
Remote attackers can escape the Chrome sandbox on Android devices and execute arbitrary code through a malicious web page rendered by WebGL.

Affected Products

Google Chrome for Android prior to 154.0.8037.57
Google Android platforms running vulnerable Chrome builds
Chromium-based components that ship the same WebGL implementation

Discovery Timeline

2026-09-29 - CVE-2026-95349 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-95349

Vulnerability Analysis

The vulnerability is a heap buffer overflow in the WebGL rendering pipeline used by Chrome on Android. WebGL exposes GPU functionality to JavaScript through a set of C++ bindings inside the Chromium renderer. When these bindings mishandle buffer sizing during graphics command processing, an attacker-controlled input can write past the bounds of a heap allocation.

Because the overflow occurs outside the sandbox, exploitation grants execution with the privileges of the browser process rather than the renderer. This bypasses one of Chrome's primary defense-in-depth boundaries on mobile. The impact chain covers confidentiality, integrity, and availability on the target device.

Root Cause

The root cause is improper bounds checking in a WebGL code path that processes attacker-supplied graphics data. See the Chromium Issue Tracker #553172761 for restricted technical details.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build on Android. No authentication is required, and the attack proceeds over the network. User interaction is limited to visiting the malicious page, which can be delivered through phishing, malvertising, or a compromised site.

No public proof-of-concept code is available. The vulnerability is described in prose only, per the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-95349

Indicators of Compromise

Chrome for Android processes crashing with heap corruption signatures shortly after loading external web content
Unexpected child processes or native library loads spawned by Chrome on Android endpoints
Outbound connections from mobile browsers to newly registered domains hosting WebGL-heavy pages

Detection Strategies

Inventory Chrome for Android builds and flag any version below 154.0.8037.57
Correlate browser crash telemetry with subsequent process execution or file writes originating from the browser sandbox
Monitor mobile threat defense telemetry for anomalous GPU driver faults tied to Chrome sessions

Monitoring Recommendations

Ingest mobile endpoint and browser telemetry into a central data lake for cross-source correlation
Alert on Chrome for Android versions that fall behind the fixed release across managed device fleets
Track access to threat-intelligence feeds covering malicious WebGL exploit domains

How to Mitigate CVE-2026-95349

Immediate Actions Required

Update Google Chrome on Android to version 154.0.8037.57 or later through the Google Play Store
Enforce mobile device management (MDM) policies that require the patched Chrome build before granting corporate resource access
Restrict use of unmanaged Android browsers on devices that handle sensitive data until the patch is verified

Patch Information

Google released the fix in the Chrome Stable channel referenced in the Google Chrome Stable Update advisory. Administrators should confirm deployment of 154.0.8037.57 or newer across all Android endpoints.

Workarounds

Direct users to an alternate, fully patched browser on Android until Chrome updates roll out
Block known malicious domains and enforce web filtering at the network edge to reduce exposure to crafted HTML pages
Disable hardware acceleration or WebGL through enterprise Chrome policies where operationally acceptable

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 154.0.8037.57 or later