CVE-2026-85050

CVE-2026-85050 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android, fixed in version 152.0.7977.82. An attacker can trigger it by persuading a user to open a crafted HTML page, since exploitation requires user interaction but no privileges. Successful exploitation yields arbitrary code execution outside the browser sandbox, giving the attacker the privileges of the user on the device, hence the critical 9.6 CVSS with scope change. Only Chrome on Android versions prior to 152.0.7977.82 are affected by this bug; desktop Chrome is not indicated in the advisory. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation of this specific CVE is known, though a related Chrome zero-day (CVE-2026-85046) was reported exploited in the wild and addressed in the same release.

What to do: Update Chrome on Android to 152.0.7977.82 or later via the Google Play Store and verify the version in chrome://version. Organizations should check MDM/EMM or Chrome enterprise version reporting for unpatched Android devices and prioritize patching, noting the same release addressed a zero-day (CVE-2026-85046) that was exploited in the wild. As an interim mitigation, users should avoid opening untrusted web pages; no other workaround is known.