An out-of-bounds read vulnerability exists in the WebGL implementation of Google Chrome on Android before version 148.0.7778.216. This vulnerability could be exploited remotely via a crafted HTML page to perform a sandbox escape, potentially leading to full compromise of the browser environment. The CVSS 3.1 score of 9.6 reflects critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed. The vulnerability is publicly disclosed with a vendor advisory link, but the patch status is not explicitly stated in the provided data.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment of Google Chrome on Android, potentially leading to execution of arbitrary code with elevated privileges. This could compromise user data, browser integrity, and availability. Given the critical CVSS score and the nature of sandbox escapes, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 148.0.7778.216 or later once available. Until then, exercise caution when browsing untrusted websites and avoid clicking on suspicious links requiring WebGL functionality.