CVE-2026-120931

Summary

A heap-based out-of-bounds write in Chrome's WebGL implementation on Android allowed remote code execution by tricking a user into visiting a malicious page.

Exploitability

Exploitation requires social engineering (user interaction) to visit a crafted HTML page; no authentication or special privileges are needed.

Blast radius

Successful exploitation could lead to full system compromise outside Chrome's sandbox, enabling data theft, malware installation, or lateral movement on the device.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade Google Chrome for Android to version 156.0.8078.47 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.