Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the… (CVE-2026-85050)

CVE-2026-85050 is an out-of-bounds write vulnerability (CWE-787) in the WebGL implementation of Google Chrome on Android. This vulnerability enables a remote attacker to execute arbitrary code outside the sandbox environment by delivering a specially crafted HTML page to the victim. The vulnerability affects versions of Chrome on Android prior to 152.0.7977.82. The CVSS 3.1 base score is 9.6, indicating critical impact with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality, integrity, and availability impacts.

Successful exploitation allows remote code execution outside the sandbox, which can lead to full compromise of the affected device's browser process and potentially the underlying system. The vulnerability impacts confidentiality, integrity, and availability at a high level.

A fix is available in Google Chrome for Android version 152.0.7977.82 and later. Users and administrators should update to this version or later to remediate the vulnerability. There is no indication that the vulnerability is currently exploited in the wild.