CVE-2026-102331

This is a heap-based buffer overflow (CWE-122) in ANGLE, the graphics translation layer Chrome uses to render WebGL and GPU-accelerated content, affecting Google Chrome on Android prior to version 154.0.8037.92. A remote attacker triggers it by convincing a victim to visit a crafted HTML page, where malicious graphics-related content corrupts memory in the ANGLE code path. Successful exploitation can yield arbitrary code execution outside the Chrome sandbox, meaning the compromise is not contained to the renderer process. All users of Chrome on Android who have not updated to 154.0.8037.92 or later are affected; desktop and other platform builds are not named in this advisory. There is no known public proof of concept and no indication of in-the-wild exploitation, though the critical severity and drive-by nature of the trigger warrant prompt patching.

What to do: Update Chrome on Android to 154.0.8037.92 or later immediately via Google Play or Settings > About Chrome, and verify the version across managed device fleets. Because the flaw can execute code outside the browser sandbox, do not rely on sandboxing or site isolation as a mitigation; treat untrusted links as high risk until patched. Enterprise and MDM admins should enforce a minimum Chrome version on BYOD Android devices.