CVE-2026-84352 in Chrome
Summary
by MITRE • 09/02/2026
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as a use-after-free error within the WebGL implementation of Google Chrome on Android represents a critical memory management flaw that compromises the integrity and confidentiality of user data. This specific defect occurs when the browser's rendering engine fails to properly manage the lifecycle of objects allocated for graphics processing tasks, specifically those handled by the OpenGL ES or Vulkan backends utilized in WebGL contexts. In this scenario, an object is deallocated from memory while there are still active references pointing to it, creating a dangling pointer situation. When the application subsequently attempts to access or manipulate data through these stale pointers, it triggers undefined behavior that can lead to arbitrary code execution. The severity of this issue is classified as critical by Chromium security standards due to its potential for remote exploitation without requiring any user interaction beyond visiting a maliciously crafted webpage.
From a technical perspective, the root cause lies in the complex interplay between JavaScript and native C++ components within the Chrome rendering architecture. WebGL relies heavily on low-level memory operations to manage textures, buffers, and shader programs efficiently. If an attacker can trigger a sequence of events that causes these resources to be freed prematurely while they are still referenced by active scripts or internal browser structures, they gain control over how subsequent memory writes are interpreted. By carefully crafting the HTML page with specific WebGL commands and timing attacks, an adversary can manipulate the heap layout to overwrite critical function pointers or return addresses in adjacent memory regions. This exploitation technique allows for the execution of arbitrary machine code within the context of the Chrome process, effectively bypassing standard sandbox protections that rely on isolating web content from system-level operations.
The operational impact of this vulnerability is severe, as it enables a remote attacker to execute arbitrary code outside the browser's security sandbox. Typically, browsers employ strict isolation mechanisms such as site-isolation and restricted permissions to prevent compromised web pages from accessing sensitive user data or modifying local files. However, successful exploitation of this use-after-free flaw grants the attacker elevated privileges within the process space, potentially leading to full system compromise depending on the Android version's security posture. An attacker could install malware, exfiltrate personal information such as passwords and financial details stored in cookies or autofill fields, or establish a persistent foothold for further lateral movement within a network if the device is connected to corporate resources. The ability to escape the sandbox transforms what might otherwise be a contained browser issue into a significant threat vector for mobile devices which often store highly sensitive personal data.
Mitigation strategies primarily involve immediate software updates and defensive programming practices. Users must ensure that Google Chrome on Android is updated to version 152.0.7977.75 or later, where the underlying memory management logic has been corrected to properly validate object lifecycles before deallocation. Developers integrating WebGL should adhere strictly to secure coding guidelines recommended by industry standards such as CWE-416, which addresses use after free errors, and implement rigorous input validation for any dynamic content generation involving graphics APIs. Additionally, enabling Chrome's built-in security features like Site Isolation can help mitigate the impact of successful exploits by limiting the scope of data accessible to a compromised renderer process. Security teams should also monitor for indicators of compromise related to unusual WebGL activity or unexpected memory allocations in browser processes as part of their threat hunting efforts aligned with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter or T1203 Exploitation for Client Execution, ensuring that any potential breaches are detected and contained promptly.