CVE Intelligence
Analysis AI-assisted

CVE-2026-9875: Google Chrome for Android WebGL out-of-bounds read

CVE-2026-9875 is an out-of-bounds read in the WebGL component of Google Chrome on Android, classified as CWE-125 and rated Critical with a CVSS 3.1 base score of 9.6. The record states that a crafted HTML page could potentially be used to perform a sandbox escape. The sources consulted do not show confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-9875 is an out-of-bounds read in WebGL in Google Chrome on Android. The record fixes the affected boundary at build 148.0.7778.216 and classifies the weakness as CWE-125. The Chromium security severity is listed as Critical.

Impact

  • The record states that a remote attacker could potentially perform a sandbox escape through a crafted HTML page.
  • The CVSS 3.1 base score is 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, reported by the CNA and by CISA-ADP.
  • The SSVC data in the record lists technical impact as total and automatable as no.

Affected products and versions

  • Google Chrome on Android prior to 148.0.7778.216.
  • The record contains a second affected-range entry that is internally inconsistent, so exact boundaries should be confirmed against the vendor release notes.

Exploitation status

The record marks the vulnerability as not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The EPSS probability is recorded as 0.00345 with a percentile of 0.26866.

Remediation and mitigation

  • Update Google Chrome on Android to 148.0.7778.216 or later, as described in the vendor stable channel release notes.
  • Prioritize devices that browse untrusted or unfamiliar web content until the update is applied.
  • Use mobile device management policies to enforce timely browser updates where available.

Detection guidance

  • Inventory Android devices with Google Chrome installed and record the installed build.
  • Flag devices running builds earlier than 148.0.7778.216 for update follow-up.
  • Review device management compliance reports for browser update status.

Limitations of the available information

The record has no entries in the fixes field and no title, and its affected-range data is inconsistent. The sources do not describe technical prerequisites or the conditions needed for a sandbox escape, and this analysis does not include exploit details.

Frequently asked questions

What is CVE-2026-9875?

It is an out-of-bounds read in WebGL in Google Chrome on Android, classified as CWE-125 and rated Critical in the record.

Which version fixes the issue?

The record describes affected builds as those prior to 148.0.7778.216, so updating to that build or later is the relevant remediation step.

Is this vulnerability known to be exploited?

The record shows it is not listed in the CISA KEV catalog, and the sources consulted do not show confirmed exploitation in the wild.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.