CVE-2026-87438

CVE-2026-87438 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, requiring no privileges and only user interaction. Successful exploitation yields arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's renderer sandbox and compromises the device at a level beyond the web content, with high confidentiality, integrity and availability impact. Users of Chrome on Android prior to 153.0.8010.36 are affected; the fix ships in Chrome 153, a release that includes roughly 230 security fixes. Exploitation of this specific WebGL flaw has not been documented so far (not in CISA KEV, EPSS ~0.4%, no public PoC); the actively exploited zero-day referenced in recent headlines is a separate V8 bug that was patched in the same Chrome 153 release.

What to do: Update Chrome on Android to 153.0.8010.36 or later (Play Store > Settings > About Chrome, or rely on auto-update) and confirm managed/fleet Android devices have received the update. As interim mitigation, avoid opening untrusted web pages until patched. Note that Chrome 153 also fixes an actively exploited V8 zero-day, so applying this update promptly is important regardless of this bug's exploitation status.