CVE-2026-106239: WebGL integer overflow in Chrome for Android may escape sandbox · ZeroHour

CVE-2026-106239

mass

WebGL integer overflow in Chrome for Android may escape sandbox

CVSS 3.1

9.6 critical

EPSS

—

Published

Oct 6, 2026 (2d ago)

Modified

Oct 7, 2026

AI analysis

An integer overflow in the WebGL implementation of Google Chrome on Android, in versions before 155.0.8059.39, can be triggered when a user opens a crafted HTML page. A remote attacker needs no privileges but does need the victim to visit that page, after which code may run outside Chrome's sandbox. Successful exploitation could give the attacker high impact on confidentiality, integrity, and availability of the device beyond the browser process. Anyone using an unpatched Chrome build on Android is affected. The issue is rated high by Chromium and critical under CVSS 3.1 (9.6); it is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Update Google Chrome on Android to version 155.0.8059.39 or later through the Play Store or Chrome's built-in updater, and confirm the installed version afterward. Until the update is applied, avoid opening untrusted or unexpected web pages in Chrome. Rely on automatic updates so devices do not remain on builds earlier than 155.0.8059.39.

Affected

Google Chrome

Android versions prior to 155.0.8059.39

Estimated exposure

masshundreds of millions to over 1 billion Android Chrome installs until updated — Chrome is the default browser on most Android devices, and Android has on the order of billions of active devices, so installs still running a build before 155.0.8059.39 are plausibly in the hundreds of millions to over a billion until…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Vendors: google
Products: chrome
Weakness: CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-106239

In the news1 stories

Google Chrome Update Fixes Massive 247 Vulnerabilities, Including 4 Code Execution Flaws