CVE-2026-9876: Use after free in WebGL in Google Chrome on Android prior to 148

Synopsis

Use-after-free in the WebGL component of Google Chrome on Android (versions prior to 148.0.7778.216) allows a remote attacker to exploit freed memory through a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does need the victim to visit a malicious page; the CVSS scope is changed, meaning a successful exploit can break out of the Chrome sandbox entirely. A successful attack gives the attacker full read, write, and availability impact on the affected host, including the ability to escape the browser sandbox. A patched-image rebuild at 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credential of any kind is required; any unauthenticated remote party can deliver the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory-layout guessing, or other environmental preconditions.

Blast Radius

• Attacker reads arbitrary memory within the Chrome process, including stored session tokens, cookies, and cached credentials.
• Attacker writes to process memory, enabling code execution inside the renderer and a full sandbox escape to the underlying Android OS.
• With sandbox escape achieved, the attacker gains the ability to read, modify, or delete files and data accessible to the Chrome process on the device.
• Service availability is fully compromised; the attacker can crash the browser process or execute persistent code on the host.