CVE-2026-103628

Summary

This flaw allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page, due to an out-of-bounds write in WebGL in Google Chrome prior to 154.0.8037.97.

Exploitability

Exploitation is highly likely given the critical severity and the need for a crafted HTML page, which can be delivered through various vectors such as phishing or malicious websites.

Blast radius

If exploited, the impact is high, as it allows execution of arbitrary code, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Google Chrome 154.0.8037.97 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.