CVE-2026-9919: Android Chrome WebGL Out-of-Bounds Read Cross-Origin Data Leak

Technical summary

CVE-2026-9919 is an out-of-bounds read vulnerability in the WebGL implementation of Chromium-based Chrome on Android. The flaw permits a remote, unauthenticated attacker to trigger memory reads beyond intended buffer boundaries via a crafted HTML page, potentially disclosing cross-origin data. The vulnerability was assigned Chromium security severity High and scored CVSS 3.1 base 4.3 (CWE-125: Out-of-bounds Read). The issue affects Chrome versions prior to 148.0.7778.216 on Android devices.

Business impact

This vulnerability poses a targeted data exfiltration risk for organizations whose users access sensitive web applications via Chrome on Android. An attacker could craft a malicious page that, when visited, leaks session tokens, authentication credentials, or other sensitive data from concurrently open sites. While the CVSS score remains moderate, the cross-origin leakage potential elevates concern for enterprises managing mobile workforces or BYOD environments. The attack requires no special network positioning or user privileges—only that a victim visit a hostile page while authenticated to sensitive services.

Affected systems

The vulnerability is specific to Google Chrome on Android operating systems, versions prior to 148.0.7778.216. Desktop and iOS versions of Chrome are not affected. Organizations should inventory mobile device deployments of Chrome, particularly those used to access corporate or sensitive web applications. Android-based Chrome instances in managed environments (MDM-enrolled devices) may be easier to patch centrally; consumer personal devices present greater patching challenges.

Exploitability

Exploitation requires user interaction (visiting a malicious or compromised webpage), lowering the attack surface compared to direct remote code execution vulnerabilities. However, the barrier is not high—a phishing email, ad injection, or watering hole attack could deliver the malicious HTML. An attacker does not need special network access or privileges. Proof-of-concept construction would be straightforward for skilled attackers familiar with WebGL APIs. This vulnerability is not currently tracked as exploited in the wild (KEV status: not listed), but that status can change.

Remediation

Update Google Chrome on all Android devices to version 148.0.7778.216 or later. The patch has been released through Google's standard Chrome update channels. For enterprise deployments, use mobile device management tools to enforce updates or restrict Chrome until patching is complete. For personal devices, enable automatic updates in Chrome settings (Settings > About Chrome > Enable automatic updates). Verify patch deployment on a sample of devices to confirm successful remediation.

Patch guidance

Google Chrome on Android receives updates through the Google Play Store. Verify that affected devices receive Chrome version 148.0.7778.216 or later by checking Settings > About Chrome, which will display the current version and initiate auto-update checks. Enterprise administrators can deploy patches via MDM solutions (Intune, MobileIron, etc.) or through managed Google Play. No manual compilation or configuration is required; the patch is delivered as a standard Chrome update.

Detection guidance

Monitor Chrome version inventory across Android devices in your environment using MDM reporting or device inventory tools. Log access patterns to sensitive web applications from mobile Chrome instances to identify potential attack attempts, though detection of successful exploitation would require advanced memory forensics or WebGL API logging on the device (not typically available in standard browser logs). Look for unusual cross-origin data access requests or anomalous data exfiltration patterns if deployed in environments with strong DLP or network monitoring.

Why prioritize this

Although the CVSS score is moderate (4.3), prioritize this vulnerability in mobile-heavy or BYOD environments due to the cross-origin data leakage potential and the ease of user-directed exploitation. If your organization relies on Android Chrome for accessing sensitive web portals, email, or financial systems, the business risk justifies rapid patching. The fix is simple (standard update) and low-friction, making this a strong candidate for urgent but manageable remediation in mobile device management schedules.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible, low-complexity attack requiring user interaction but with only confidentiality impact (no integrity or availability loss). The vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N appropriately captures the attack surface. The 'Medium' severity rating aligns with the bounds-read class and limited scope; however, the cross-origin leakage aspect and mobile deployment ubiquity warrant treating this more urgently than the raw score might suggest in a BYOD or managed device context.

Frequently asked questions