External risk intelligence

Chrome for Android WebGL Out of Bounds Write Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-120931

This vulnerability exists within the WebGL implementation of a web browser client. Exploitation requires a user to navigate to a specifically crafted HTML page. As a client-side application feature that is not an internet-facing service, gateway, or reachable management interface, it does not meet the criteria for public network exposure.

Out-of-bounds Write

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Google Chrome on Android could allow a remote attacker to execute arbitrary code by tricking a user into visiting a malicious web page. This issue is in the WebGL component, which is used for graphics rendering.

WebGL flaw allows code execution via web pages.
Critical severity, but requires user interaction.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage that exploits a flaw in Chrome's WebGL component on Android. This flaw allows the attacker to execute code remotely, potentially leading to the compromise of the user's device.

User must visit a malicious page.
WebGL component in browser.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a remote attacker could potentially execute arbitrary code outside the sandbox by tricking a user into visiting a crafted HTML page within Google Chrome on Android. This could impact the integrity and availability of the user's device, and potentially lead to unauthorized access to sensitive information.

User-controlled web pages.
Crafted HTML leading to code execution.
Compromise of device integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Chrome's WebGL implementation on Android, allowing arbitrary code execution, necessitates immediate attention from teams responsible for endpoint security and application management. The first practical step is to identify all Android devices utilizing the affected browser version, assess their exposure and business criticality, and confirm the owner of these endpoints. Subsequently, a coordinated remediation plan, considering maintenance windows and potential user impact, should be developed.

Endpoint security and application owners.
Confirm affected Android devices and exposure.
Plan coordinated remediation and user communication.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the role of WebGL in Google Chrome on Android?

WebGL is a browser technology that allows Chrome to render 2D and 3D graphics directly within the web page. It leverages the device's graphics processing unit (GPU) to display complex visual content, such as interactive games or data visualizations, without requiring additional plugins.

What does an out-of-bounds write vulnerability mean?

This weakness, classified as CWE-787, occurs when software writes data past the intended boundary of a memory buffer. In CVE-2026-120931, this flaw in the WebGL component allows a specially crafted webpage to corrupt adjacent memory, which an attacker can manipulate to execute unauthorized code on the device.

How is this WebGL flaw triggered?

An attacker must trick a user into navigating to a malicious website containing crafted HTML. The vulnerability does not trigger automatically; it requires the user to load the specific page in an affected version of Chrome on Android. Simply having the browser installed or running it without visiting the malicious page does not activate the bug.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal notes that this vulnerability affects a client-side browser component, not an internet-facing server or gateway. Because it requires user action to trigger, it is classified as very unlikely to be exposed as an external, reachable service in the traditional sense, though individual mobile users remain susceptible if they visit compromised sites.

What should I do if I use Chrome on Android?

First, verify the version of Google Chrome running on your Android devices to see if it is prior to 156.0.8078.47. If your version is affected, prioritize updating the application through the official app store. Coordinate with your device management team to ensure all managed mobile endpoints receive the latest security patches provided by Google.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.