CVE-2026-93372: Google Chrome Android WebGL Heap Buffer Overflow GPU Sandbox Escape

HERMES

HERMES THREAT SCORE & MOBILE BROWSER SANDBOX ESCAPE

Target: Google Chrome for Android — WebGL ANGLE / OpenGL ES Translation Subsystem

Confidence: 97%

91 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 19 / 20

Exposure 19 / 20

Prevalence 20 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Rated CVSS 8.8 and HTS 91 (CRITICAL). Buffer overflows in GPU rendering pipelines on mobile operating systems bypass traditional renderer sandboxes. When triggered via a malicious webpage, this vulnerability grants GPU process arbitrary memory corruption and native device command execution.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-93372: Google Chrome Android WebGL Heap Buffer Overflow GPU Sandbox EscapeVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTGoogle Chromium / V8 Engine

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Google Chromium / V8 Engine documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Chrome Stable Channel Release: September 2026

CVSS v3.1: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) / CWE-122: Heap-based Buffer Overflow / CWE-120: Buffer Copy without Checking Size. Affects Google Chrome for Android prior to version 153.0.8010.52.

Executive Summary

Disclosed in the September 2026 Google Chrome Stable channel updates, CVE-2026-93372 is a heap-based buffer overflow in the ANGLE graphics abstraction layer and WebGL texture handling subsystem on Android. An attacker hosting a malicious website can serve specially crafted WebGL shader calls and compressed texture dimensions, triggering out-of-bounds writes in the Chrome GPU process memory space to break out of the browser sandbox.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-93372	Google Chrome Android Security Release
Vulnerability Class	Heap Buffer Overflow (CWE-122 / CWE-120)	Sandbox escape and arbitrary code execution
Affected Component	WebGL ANGLE / OpenGL ES Texture Decompressor	Chromium GPU Process
Authentication Required	None (PR:N)	Attacker lures user to visiting a crafted URL
User Interaction	Required (UI:R)	User navigates to malicious web page
Scope Impact	Changed (S:C)	Escapes browser renderer into host GPU/Android OS context
Privileges Obtained	Android Application Sandbox Escape	Arbitrary native code execution under Chrome context
Affected Versions	Google Chrome for Android < 153.0.8010.52	Mobile Chrome browser instances
Remediation Target	Google Chrome 153.0.8010.52	Update via Google Play Store / Enterprise MDM

---

2. Vulnerability Anatomy & Root Cause Analysis

graph TD
    Web["Malicious Web Page"] --> Canvas["HTML5 Canvas WebGL gl.compressedTexImage2D()"]
    Canvas --> ANGLE["ANGLE OpenGL ES Backend"]
    ANGLE --> SizeCalc["Integer Calculation of Mipmap Texture Bounds"]
    SizeCalc --> Overflow["Integer Truncation -> Heap Buffer Overflow"]
    Overflow --> GPUCorrupt["Corrupt Adjacent GPU Command Buffer Structures"]
    GPUCorrupt --> Escape["Execute Native Shellcode outside Browser Sandbox"]

1. WebGL texture decompression in ANGLE calculates buffer sizes using texture dimensions and mipmap level parameters.
2. A calculation flaw allows an integer truncation when handling abnormal dimension boundaries in compressed ASTC / ETC2 texture formats.
3. The allocated buffer is smaller than the decompression payload, resulting in a heap buffer overflow that corrupts surrounding GPU command buffer dispatch tables.

---

3. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Update Chrome on Android: Deploy Google Chrome 153.0.8010.52 or newer via Google Play Store or enterprise Mobile Device Management (MDM).
2. T1 Mitigation — Disable WebGL via Enterprise Policy: If devices cannot be patched immediately, deploy Chrome Enterprise policy to disable WebGL:

   {
     "Disable3DAPIs": true
   }

---

4. Related Intelligence & Attack Paths

Google Chromium / V8 Intelligence Explore vulnerability trends, architecture details, and hardening guides for Chromium.

Chrome Workers Use-After-Free (CVE-2026-91749) Analyze the companion browser RCE flaw disclosed in the same release window.

Private Stack Audit Audit your mobile fleet against CVE-2026-93372 privately in your browser.