CVE-2026-91726

CVE-2026-91726 is an out-of-bounds read (CWE-125) in the WebGL implementation of Google Chrome on Android, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by convincing a user to visit a crafted HTML page, which causes the browser to read memory outside of Chrome's sandbox. Although the CVSS 3.1 base score is 4.7 (medium) due to the requirement for user interaction and limited confidentiality-only impact, Google's Chromium team rates it Critical because defeating the sandbox boundary undermines Chrome's core security model. Only Chrome on Android versions prior to 153.0.8010.47 are affected; desktop and other-platform Chrome builds are not in scope per the advisory. There is no known public proof of concept, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported; the flaw was patched as one of three critical issues in the Chrome 153 update.

What to do: Update Chrome on Android to 153.0.8010.47 or later immediately (Settings > About Chrome, or via Google Play) — the fix is included in the Chrome 153 release. For managed Android fleets, verify the deployed Chrome version and push the update rather than waiting for the automatic rollout. Because exploitation only requires a user to visit a malicious page, no special network mitigation exists beyond patching; investigate any reports of sensitive process memory disclosures on unpatched devices.