Loading vulnerability…
WebGL Out-of-Bounds Write in Google Chrome for Android
CVE-2026-87438 is a critical out-of-bounds write vulnerability in the WebGL component of Google Chrome for Android before version 153.0.8010.36. Processing a specially crafted HTML page can trigger memory corruption and allow a remote attacker to execute arbitrary code outside the Chrome sandbox. The specific vulnerable function and underlying memory-management error have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution outside Chrome's sandbox, compromising browser isolation and potentially exposing data, enabling unauthorized modification, or disrupting availability within the privileges of the affected process. The vulnerability does not establish root-level access or unrestricted control of the Android device.
If you can’t patch tonight, do this now.
Until the update is deployed, restrict access to untrusted web content and limit use of affected browser installations. Consider disabling or limiting WebGL where supported by applicable enterprise browser policies. These measures reduce exposure but are not substitutes for updating.
Patch, then assume compromise.
Upgrade Google Chrome for Android to version 153.0.8010.36 or later. For Chromium-derived products that list this CVE, apply the corresponding vendor update: Debian stable (trixie) Chromium 153.0.8010.47-2~deb13u1, Microsoft Edge 153.0.4234.49 or later, or Prisma Browser 153.3.3.37 or later for this CVE. Prisma Browser 155.16.5.40 or later addresses the complete October advisory. Inclusion in a bundled update does not independently establish that every listed platform is exploitable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.