CVE Intelligence
Analysis AI-assisted

CVE-2026-9876: Google Chrome for Android WebGL use-after-free

Google Chrome on Android has a use-after-free flaw in WebGL that, according to the record, could let a remote attacker attempt a sandbox escape via a crafted HTML page. The CNA and CISA-ADP both list a CVSS 3.1 base score of 9.6, and Chromium rates the issue Critical. The sources consulted show no CISA KEV listing and no confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

A use-after-free weakness in the WebGL component of Google Chrome on Android is tracked as CVE-2026-9876 (CWE-416). According to the record, a remote attacker could potentially use a crafted HTML page to escape the browser sandbox. The Chromium project rates the issue as Critical.

Impact

  • The CVSS 3.1 base score is 9.6 (Critical), reported by the CNA and also recorded by CISA-ADP, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
  • The vector indicates a network attack, low complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity and availability.
  • The SSVC data records technical impact as total, exploitation as none and automatable as no.

Affected products and versions

  • Product: Google Chrome on Android.
  • The affected range is listed as before 148.0.7778.216.
  • The record contains a second, contradictory range entry (from 148.0.7778.216 and before 148.0.7778.216). It cannot be satisfied and should not be read as a usable range.
  • The fixes list in the record is empty. The linked release notes point to a stable channel update for desktop.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted. SSVC records exploitation as none, and EPSS gives a probability of 0.00345 with a percentile of 0.26864.

Remediation and mitigation

  • Update Google Chrome on Android to 148.0.7778.216 or later. The affected range implies this is the first version outside the vulnerable range.
  • Verify the installed version on managed Android devices and confirm that automatic updates are enabled.
  • Until the update is applied, limit browsing to trusted sites where possible and reduce exposure to untrusted HTML content, in line with organizational policy.

Detection guidance

  • Inventory Chrome versions across Android devices and flag any version below 148.0.7778.216.
  • Review mobile device management reports for browsers that have not received the stable channel update.
  • Monitor for unexpected browser crashes on Android endpoints, recognizing that such signals are not specific to this CVE.

Limitations of the available information

  • The record includes no vendor advisory beyond the Chromium issue tracker entry, which is marked as restricted.
  • The fixes list is empty and the affected range contains a contradictory entry.
  • Technical details of the defect are not available in the record, and no public exploit information is indicated in the sources consulted.
  • The EPSS date (2026-10-23) is later than the publication date, so its meaning should be verified against the EPSS source.
  • The record does not state whether desktop Chrome or other platforms are affected.

Frequently asked questions

Is this CVE listed as actively exploited?

No. CISA KEV does not list CVE-2026-9876, and no confirmed exploitation appears in the sources consulted.

Which Chrome version should be installed?

The affected range is before 148.0.7778.216, so version 148.0.7778.216 or later is the target. This is an inference from the range listed in the record.

Does the record confirm a fix list?

No. The fixes list is empty, which does not mean that no fix exists. The linked release notes describe a stable channel update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.