{"id":"CVE-2026-120931","kind":"vulnerability","aliases":["CVE-2026-120931"],"related":[],"title":"Chrome on Android: WebGL memory write lets crafted page run code","description":"Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","summary":"An out-of-bounds write in WebGL in Google Chrome on Android lets a crafted HTML page make the browser write outside its memory bounds. A remote attacker can use this to execute arbitrary code outside the browser sandbox.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","browser","chrome","other","webgl"],"not_affected_if":["chrome-updated","non-android-desktop"],"how_to_check":"- Open Chrome on the Android device and check the version under Settings > About Chrome.\n- Versions before `156.0.8078.47` are affected according to the NVD description.","fix":"- Google Chrome on Android: move to `156.0.8078.47` or later.","status":"open","published_at":"2026-11-03T22:19:31+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","triaged_at":"2026-11-03T23:16:10+00:00","updated_at":"2026-11-03T23:16:10+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-03T23:16:10Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome on Android: move to `156.0.8078.47` or later.","reach":"internet","title":"Chrome on Android: WebGL memory write lets crafted page run code","impact":"high","summary":"An out-of-bounds write in WebGL in Google Chrome on Android lets a crafted HTML page make the browser write outside its memory bounds. A remote attacker can use this to execute arbitrary code outside the browser sandbox.","audience":"everyone","category":"other","nicknames":[],"who_cares":["chrome","android","webgl","browser"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs arbitrary code outside the browser sandbox on the device.","analyst_note":"","how_to_check":"- Open Chrome on the Android device and check the version under Settings > About Chrome.\n- Versions before `156.0.8078.47` are affected according to the NVD description.","plain_action":"Update Chrome on your Android phone to version 156.0.8078.47 or later through the Play Store.","needs_analyst":false,"not_affected_if":["chrome-updated","non-android-desktop"],"who_is_affected":"Any Android device running Chrome older than 156.0.8078.47 is exposed when the user visits a malicious web page. Exploitation needs the user to open the page, and the sources do not say whether WebGL must be enabled beyond default settings. Managed fleets should confirm the Chrome version on each device.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000684,"input_tokens":4119,"output_tokens":544,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120931':14A,17A '-2026':13A,16A '156.0.8078.47':77C 'allow':78C 'android':3A,18B,35B,74C 'arbitrari':57B,84C 'attack':51B,81C 'bound':27B,48B,65C 'browser':19B,43B,61B 'chrome':1A,20B,33B,71C 'chromium':94C 'code':11A,58B,85C 'craft':8A,38B,91C 'critic':97C 'cve':12A,15A 'execut':56B,83C 'googl':32B,70C 'html':39B,92C 'let':7A,36B 'make':41B 'memori':5A,47B 'out-of-bound':24B 'outsid':45B,59B,86C 'page':9A,40B,93C 'prior':75C 'remot':50B,80C 'run':10A 'sandbox':62B,88C 'secur':95C 'sever':96C 'use':53B 'via':89C 'webgl':4A,22B,30B,68C 'write':6A,28B,44B,66C","nicknames":[],"mitigations":[],"who_affected":"Any Android device running Chrome older than 156.0.8078.47 is exposed when the user visits a malicious web page. Exploitation needs the user to open the page, and the sources do not say whether WebGL must be enabled beyond default settings. Managed fleets should confirm the Chrome version on each device.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Chrome on your Android phone to version 156.0.8078.47 or later through the Play Store.","pkeys":[],"ptokens":[],"labels":["android","browser","chrome","critical","other","webgl"],"campaign_type":null,"first_public_at":"2026-11-03T22:19:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120931","severity":null,"published_at":"2026-11-03T22:19:31+00:00","modified_at":"2026-11-03T22:19:32+00:00","first_seen_at":"2026-11-03T23:15:08+00:00","fetched_at":"2026-11-03T23:15:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}