External risk intelligence

Chrome for Android WebGL Out of Bounds Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-85050

This vulnerability affects a web browser, which is inherently designed to navigate the public internet and process untrusted external content. As a client-side application that routinely interacts with public web servers, the exposure surface is significant and frequently accessible in normal usage patterns.

Out-of-bounds Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability within the WebGL component of Google Chrome on Android. The issue, an out-of-bounds write, could allow a remote attacker to execute malicious code outside the browser's secure sandbox by tricking a user into visiting a specially crafted webpage. This type of vulnerability presents a significant risk due to the widespread use of web browsers for accessing information and services.

A code execution flaw exists in Chrome's Android browser.
It allows attackers to run harmful code remotely.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage. This webpage would contain specially crafted code that exploits a flaw in how the WebGL component of Chrome on Android handles certain data. By overwriting memory outside of its intended boundaries, the attacker could potentially execute their own code, leading to a compromise of the user's device.

Requires user to visit a malicious site.
Triggers an out-of-bounds write.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code outside the sandbox on Android devices when viewing a crafted HTML page. This could affect the confidentiality, integrity, and availability of the device's system.

System data or user data could be at risk.
Via a crafted HTML page in the browser.
Compromise of device and data confidentiality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Google Chrome on Android, specifically versions prior to 152.0.7977.82. Ownership likely falls to the platform or mobile device management teams responsible for endpoint security and browser management. The initial practical move involves identifying all Android devices utilizing the affected Chrome version, assessing exposure based on user activity and critical business functions, and coordinating with vendor management for vendor-supplied devices or applications.

Platform and MDM teams own the issue.
Verify affected Chrome versions and reachability.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome on Android?

Google Chrome on Android is a web browser application used to access the internet. It includes a WebGL component, which allows the browser to render 2D and 3D graphics directly within web pages using the device's hardware acceleration. This technology is foundational for modern web-based gaming, data visualization, and interactive graphics.

What does out-of-bounds write mean for CVE-2026-85050?

This vulnerability is classified as an out-of-bounds write (CWE-787). In plain terms, the WebGL component fails to verify that the data it is writing stays within its allocated memory space. An attacker can manipulate this flaw to write data into memory that belongs to other parts of the application, potentially gaining control over the device.

How is this Chrome vulnerability triggered?

An attacker triggers this flaw by luring a user to a specially crafted HTML page. When the browser renders the malicious content, it interacts with the WebGL component in an unexpected way. Simply having the browser installed or running without navigating to a specific, malicious webpage does not trigger this vulnerability.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is likely to affect your environment because web browsers are designed to interact with untrusted, public internet content. Since users frequently visit various sites, the browser's exposure surface is naturally high, making it a common target for remote attacks.

How should I respond to this security update?

Your first step is to identify all Android devices in your environment running Chrome versions older than 152.0.7977.82. Once identified, prioritize updating these devices to the latest available version provided by Google. Coordinate with your device management or IT support teams to ensure these security updates are applied consistently across all mobile assets.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.