External risk intelligence

Chrome for Android WebGL Sandbox Escape Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-9875

The vulnerability exists in a web browser, which is an internet-facing application by design. Users frequently encounter crafted HTML content while browsing the public web, making the attack surface commonly reachable during normal web browsing activities.

Out-of-bounds Read

Google Chrome

before 148.0.7778.216

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in Chrome on Android allows a remote attacker to potentially escape the browser's security sandbox by tricking a user into visiting a malicious webpage. While the immediate business impact is unclear without further analysis, the potential for significant compromise warrants attention to understand our exposure.

Read vulnerability allows escaping browser security.
Could impact user data and system integrity.
Confirm relevance and scope of potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by directing a user to a malicious web page. The vulnerability resides in the WebGL component within Google Chrome on Android. When a user visits this crafted page, it can trigger an out-of-bounds read, potentially leading to a sandbox escape.

Requires a user to visit a malicious page.
Triggered by a crafted HTML page.
Potential sandbox escape.

Live Threat

Current exploitation, exposure, and threat context

An out-of-bounds read vulnerability in WebGL within Chrome on Android could allow a remote attacker to potentially escape the browser's sandbox. This could occur when a user visits a specially crafted HTML page.

Browser sandbox.
Via a crafted HTML page.
Sandbox escape.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining ownership for this vulnerability requires understanding where Chrome on Android is deployed and managed. Typically, mobile device management (MDM) solutions or platform teams handle the distribution and patching of browser applications on managed Android devices. For unmanaged devices, individual users or their device administrators are responsible. The first practical step is to identify all Chrome instances on Android within the environment, assess their reachability, and confirm their business criticality to prioritize remediation efforts with the appropriate teams.

Mobile platform or device owners.
Verify Chrome browser deployment scope.
Coordinate managed update deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for Android and how does WebGL work?

Google Chrome for Android is a mobile web browser built on the Chromium engine. WebGL is a core component within the browser that allows it to render interactive 3D and 2D graphics using hardware acceleration. By leveraging the device's graphics processing unit (GPU), it enables complex visual content to run directly within webpages.

What does an out-of-bounds read mean in the context of CVE-2026-9875?

An out-of-bounds read is a weakness, classified as CWE-125, that occurs when software accesses data beyond the intended buffer limits. In CVE-2026-9875, this allows a crafted webpage to read memory it should not access. This flaw is dangerous because it can be a stepping stone for an attacker to bypass the browser's sandbox security, which is designed to keep web content isolated from the rest of the device.

How is this vulnerability triggered?

An attacker triggers this bug by enticing a user to visit a specially crafted HTML page. The vulnerability is specifically linked to processing malicious WebGL content. Importantly, simply having the browser installed does not trigger the flaw; it requires the active rendering of the malicious webpage content within the Chrome browser on an affected version.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is highly relevant because web browsers are internet-facing applications by design. Since users frequently navigate to public web content, the attack surface is considered commonly reachable. If your devices use an affected version of Chrome on Android, they are potentially exposed whenever they browse the web.

What should I do if I am running this technology?

The primary response is to ensure Chrome is updated to version 148.0.7778.216 or later. Start by identifying where Chrome is deployed within your environment, including both managed and unmanaged devices. Coordinate with your mobile device management (MDM) or platform teams to prioritize and roll out the necessary browser updates to all affected Android devices.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.