Live › vulnerability › CVE-2026-120931
An out-of-bounds write in WebGL in Google Chrome on Android lets a crafted HTML page make the browser write outside its memory bounds. A remote attacker can use this to execute arbitrary code outside the browser sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:15 UTC. All times on this page are UTC.
Any Android device running Chrome older than 156.0.8078.47 is exposed when the user visits a malicious web page. Exploitation needs the user to open the page, and the sources do not say whether WebGL must be enabled beyond default settings. Managed fleets should confirm the Chrome version on each device.
No product ranges from the sources yet.
156.0.8078.47 are affected according to the NVD description.156.0.8078.47 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
This page as .md · .json · in your agent: get_signal("CVE-2026-120931")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.