Loading vulnerability…
Remote Code Execution in Google Chrome for Android WebGL
CVE-2026-87488 is a critical use-after-free vulnerability in the WebGL component of Google Chrome for Android before version 153.0.8010.36. Processing a specially crafted HTML page can trigger the memory-safety flaw, allowing a remote attacker to execute arbitrary code outside the browser sandbox. The specific vulnerable function and object-lifetime sequence have not been disclosed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through arbitrary code execution outside Chrome's sandbox. This bypasses the browser's sandbox containment, potentially allowing access to data and resources available to the compromised process. Android system-level or root privileges are not established.
If you can’t patch tonight, do this now.
Until the update is deployed, restrict use of vulnerable browser installations and reduce exposure to untrusted web content. Apply mobile web-filtering or browser-isolation controls where available. These measures reduce exposure but are not a confirmed workaround for the underlying use-after-free.
Patch, then assume compromise.
Update Google Chrome for Android to version 153.0.8010.36 or later. For Chromium-derived products whose vendor advisories include this CVE, install the corresponding vendor update. Listed fixes include Microsoft Edge 153.0.4234.49, Prisma Browser 153.3.3.37, and Debian stable (trixie) Chromium 153.0.8010.47-2~deb13u1. Confirm platform applicability with each vendor; inclusion in a multi-vulnerability desktop advisory does not establish that the Android-specific exploit applies unchanged to desktop platforms.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.