Skip to content
NewA calmer, faster ZeroHour
Vulnerability1 · 1 read

CVE-2026-121246

Use after free in WebGL in Google Chrome on Android prior to 157.0.8103.38

CVSS 3.1
9.6 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-121246 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Use after free in WebGL in Google Chrome on Android allowed remote attackers to execute arbitrary code outside the sandbox via a crafted HTML page. User interaction is required to trigger via visiting the page. This affects all users of Google Chrome on Android prior to 157.0.8103.38.

What to do: Upgrade Google Chrome on Android to 157.0.8103.38 or later.

ProductAffectedFixed in
Google ChromeAndroid prior to 157.0.8103.38157.0.8103.38
Estimated exposure
massNo basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Vendors
google
Products
chrome
Weakness
CWE-416
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

In the news

2 stories