CVE-2026-9875: Out of bounds read in WebGL in Google Chrome on Android prior to 148

Synopsis

An out-of-bounds read vulnerability in the WebGL component of Google Chrome on Android allows a remote attacker to trigger a sandbox escape by luring a user to a crafted HTML page. The attack is reachable over the network, requires no authentication, and only needs the victim to visit a malicious page. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the browser sandbox. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account, session, or credential of any kind is needed to deliver the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker escapes the Chrome browser sandbox on Android, gaining execution context outside the browser's normal isolation boundary.
• With sandbox escape achieved, the attacker reads sensitive data accessible to the device user, including stored credentials, session tokens, and local files.
• The attacker modifies application data, installs payloads, or alters persisted storage on the device.
• The attacker can crash or destabilize the browser process or dependent system services, disrupting availability for the affected user.