CVE Intelligence
Analysis AI-assisted

CVE-2026-106239: Google Chrome WebGL Integer Overflow on Android

CVE-2026-106239 is an integer overflow (CWE-190) in WebGL in Google Chrome on Android. The description states that a remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page. The CVSS base score is 9.6 and the record rates the issue as critical, but it is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-106239 describes an integer overflow (CWE-190) in WebGL in Google Chrome on Android. The description states that a remote attacker could potentially use a crafted HTML page to execute arbitrary code outside the browser sandbox. The record was published on 2026-10-06 by the Chrome CNA and marks the Chromium security severity as High.

Impact

  • The description states a potential for arbitrary code execution outside the sandbox.
  • The CVSS vector in the record indicates a network attack with low complexity, no privileges required, user interaction required, and a changed scope with high confidentiality, integrity and availability impact.
  • Real-world impact depends on the victim being induced to load a malicious page; this is an inference from the user interaction metric.

Affected products and versions

  • The description identifies Google Chrome on Android before 155.0.8059.39.
  • The structured affected list is inconsistent: one of its two entries describes an empty range, so it does not give a clean version range.
  • The fixes field is empty. The fixed boundary used here comes from the description, not from a separate fix entry.

Exploitation status

The CISA KEV catalog does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The SSVC exploitation value is none and the automatable value is no. The EPSS probability is 0.00423 with a percentile of 0.35603, dated 2026-10-23.

Remediation and mitigation

  • Update Google Chrome on Android to 155.0.8059.39 or later, following the Chrome stable channel release notes.
  • Confirm the installed browser version on managed Android devices and apply updates through the standard application channel.
  • Until updates are applied, reduce exposure by avoiding untrusted links and pages (inference from the crafted HTML trigger).

Detection guidance

  • Inventory Android devices with Chrome and compare installed versions against the 155.0.8059.39 threshold.
  • Review mobile threat telemetry for unexpected browser crashes or unusual browser process activity. The sources consulted do not provide specific indicators.

Limitations of the available information

  • The record has no English title and no fixed-version field.
  • The affected product entry names only Google Chrome; the Android scope comes from the description.
  • The issue tracker entry is tagged as requiring permissions, so technical details could not be verified.
  • No independent exploitation analysis or proof-of-concept status is available in the record.

Frequently asked questions

What is CVE-2026-106239?

It is an integer overflow in WebGL in Google Chrome on Android. The description says it could potentially allow arbitrary code execution outside the sandbox through a crafted HTML page.

Which versions are affected?

The description says Chrome on Android versions before 155.0.8059.39 are affected. The structured affected list is inconsistent, so the description is the main reference.

Is this vulnerability being exploited?

It is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.