CVE-2026-93372

CVE-2026-93372 is a buffer overflow (CWE-121) in the WebGL component of Google Chrome on Android, fixed in Chrome 153.0.8010.52. A remote attacker can trigger it by luring a user to a crafted HTML page that renders malicious WebGL content, causing memory corruption in the browser process. Successful exploitation allows arbitrary code execution outside the sandbox, which defeats Chrome's key containment boundary and grants the attacker significantly broader access on the device. All Chrome for Android users running versions prior to 153.0.8010.52 are affected; the flaw carries a Critical Chromium security severity rating. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not on CISA's KEV list; it was patched as one of 16 flaws in the Chrome 153 release.

What to do: Update Chrome on Android to version 153.0.8010.52 or later via the Google Play Store and verify the version at chrome://version. Until patched, avoid following links from untrusted sources, since a crafted web page alone can trigger the flaw. Organizations should use MDM/enterprise policies to force the Chrome update fleet-wide, and desktop users should also apply the latest Chrome 153 release, which fixes 16 issues including two critical ones.