External risk intelligence

Google Chrome Android WebGL Use After Free Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-84352

The vulnerability exists in the WebGL implementation of a widely used web browser. As web browsers are primary tools for accessing the public internet and routinely process arbitrary, potentially malicious HTML content from external websites, the attack surface is considered likely to be exposed during normal operation.

Use After Free

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the WebGL component of Google Chrome on Android, potentially allowing unauthorized code execution outside the browser's secure environment through malicious web pages.

Flaw in browser's graphics handling.
Threat to user data and system integrity.
Confirm browser relevance for risk assessment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking a user into visiting a malicious webpage. This page would contain specially crafted HTML designed to trigger a use-after-free flaw in the browser's WebGL component. Successful exploitation could allow the attacker to execute code on the user's device, potentially bypassing security boundaries.

Entry condition: User visits a malicious webpage.
Trigger point: Crafted HTML interacts with WebGL.
Resulting risk: Arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome's WebGL component could allow a remote attacker to execute arbitrary code outside the browser's sandbox. This could occur when a user visits a crafted HTML page.

Arbitrary code execution outside sandbox.
Via crafted HTML page when browsing.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Google Chrome's WebGL component on Android requires immediate attention from teams managing web applications and end-user devices. The first step is to determine the scope of affected devices, assess their exposure to the internet, and identify the business criticality of Chrome usage, particularly concerning access to untrusted web content. Following this, the accountable owner for Chrome management and updates should be engaged to plan remediation efforts based on the identified risk.

Chrome or device management teams own remediation.
Verify Chrome version and internet reachability.
Plan updates and coordinate with users.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WebGL component in Google Chrome on Android?

WebGL is a JavaScript API used within the browser to render interactive 2D and 3D graphics directly on your device. It enables complex visual experiences and gaming without needing extra plugins. In Google Chrome, this component works closely with the device's hardware to display web content efficiently.

What does a use-after-free vulnerability mean for CVE-2026-84352?

This is a memory management weakness, classified as CWE-416. It occurs when a program continues to use a pointer to a memory location after that memory has been cleared or freed. In this specific CVE, an attacker can manipulate this flaw to cause the browser to perform unexpected actions, potentially leading to unauthorized code execution.

How is this vulnerability triggered by a malicious webpage?

The flaw is triggered when a user visits a specifically crafted HTML page designed to interact with the WebGL component. Simply having the browser installed or running is not enough to trigger the bug; the browser must actively parse and render the malicious graphics instructions embedded in the page.

Why does Halo Surface Signal categorize this threat as likely?

Halo Surface Signal assesses this as likely because Google Chrome is a primary tool for accessing the public internet. Since browsers routinely process arbitrary content from various websites, the WebGL component is frequently exposed to external input, making it a viable target for remote attackers.

Is there a recommended first step to address this Chrome vulnerability?

You should begin by verifying which devices in your environment are running affected versions of Chrome on Android. Once identified, coordinate with the teams responsible for device management to prioritize and schedule the necessary software updates to the patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.