CVE-2026-120931 in Chrome
Summary
by MITRE • 11/03/2026
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an out-of-bounds write within the WebGL subsystem of Google Chrome on Android represents a critical memory corruption flaw that undermines the browser's core security model. This issue stems from improper bounds checking during the processing of graphics commands, specifically when handling shader programs or texture operations via JavaScript APIs exposed to web content. When a remote attacker constructs a malicious HTML page containing specially crafted WebGL calls, they can trigger an execution path where data is written beyond the allocated memory buffer boundaries. Because this occurs within the renderer process which operates under strict sandboxing restrictions designed to isolate untrusted code from the host operating system and user files, the ability to write outside these bounds allows for a breach of that isolation boundary.
From a technical perspective, out-of-bounds writes are particularly dangerous because they can corrupt adjacent memory structures such as function pointers, object headers, or heap metadata. In the context of Chromium's V8 JavaScript engine and its interaction with native C++ components like Skia orANGLE which handle WebGL rendering, this corruption can lead to arbitrary code execution if an attacker successfully controls the data written outside the buffer. The severity is classified as critical because it enables a remote attacker who merely convinces a user to visit a malicious webpage to execute arbitrary commands on the victim's device with the privileges of the browser process. This effectively neutralizes the sandbox, which is the primary defense mechanism against web-based attacks in modern browsers.
The operational impact of this vulnerability extends beyond simple data leakage or denial of service. Successful exploitation allows for full system compromise depending on the specific memory layout and available exploit primitives. An attacker could potentially install malware, steal sensitive credentials stored by the browser, perform keylogging, or use the compromised device as part of a botnet. Given that WebGL is widely used in web-based games, 3D visualizations, and data visualization tools, the attack surface is significant. Users interacting with untrusted third-party content are at high risk if they have not updated their Chrome browser to version 156.0.8078.47 or later on Android devices.
This vulnerability aligns closely with CWE-787: Out-of-bounds Write, which describes writing data outside the bounds of a buffer, potentially leading to code execution or denial of service. In terms of offensive security frameworks, this flaw facilitates techniques associated with MITRE ATT&CK T1203: Exploitation for Client Execution, where attackers leverage vulnerabilities in client-side software to execute malicious payloads without user interaction beyond visiting a webpage. It also relates to privilege escalation within the application context by breaking out of the renderer sandbox, which can be mapped to lateral movement or persistence strategies if combined with other post-exploitation techniques.
Mitigation for this vulnerability primarily involves immediate patching. Administrators and users must ensure that Google Chrome on Android is updated to version 156.0.8078.47 or a later release where the bounds checking logic in the WebGL implementation has been corrected. For organizations deploying managed browsers, enforcing automatic updates through mobile device management policies is recommended to reduce exposure windows. Additionally, while technical mitigations like sandboxing are already present and were bypassed here, defense-in-depth strategies such as enabling site isolation features more aggressively can help limit the blast radius of any future exploits by further restricting cross-origin data access within the browser environment.