CVE-2026-85050: Out of bounds write in Google Chrome

This vulnerability involves an out-of-bounds write in the WebGL subsystem of Google Chrome on Android devices. Exploitation requires user interaction (visiting a malicious HTML page) and can lead to arbitrary code execution outside the browser sandbox, compromising system security. The issue is tracked as CVE-2026-85050 and has a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). The affected versions are all Chrome versions before 152.0.7977.82 on Android. Google published an advisory linked to a stable channel update but does not explicitly state the patch status or remediation level in the provided data.

Successful exploitation allows remote attackers to execute arbitrary code outside the sandbox on affected Android devices running vulnerable Chrome versions. This can lead to full compromise of the browser and potentially the underlying system, affecting confidentiality, integrity, and availability. No active exploitation in the wild is currently known.

Check the Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html for the latest patch information. Since the advisory is linked to a stable update, it is likely that a fix is available in Chrome version 152.0.7977.82 or later. Users should update Chrome on Android to version 152.0.7977.82 or newer to mitigate this vulnerability. Patch status is not explicitly confirmed in the advisory content provided; verify with the vendor for current remediation guidance.