CVE-2026-9929: Chrome Android WebGL Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-9929 is an inappropriate implementation vulnerability in the WebGL subsystem of Google Chrome on Android. The flaw permits cross-origin data leakage when a user visits a crafted HTML page. The attack surface is the rendering engine's WebGL implementation, which does not properly isolate graphics memory or context state between origins. An attacker can construct a webpage that, through crafted WebGL operations, reads or infers data from other open tabs or frames. Chromium classifies this as High severity internally, though the CVSS 3.1 score of 4.3 reflects the requirement for user interaction and the limited direct impact (confidentiality only, no integrity or availability loss).

Business impact

For most organizations, the risk is indirect but non-negligible. End users—especially those handling sensitive work in web applications—could have session tokens, form data, or other cross-origin content leaked to attacker-controlled scripts. This is particularly concerning in multi-tab browsing scenarios where users may have authentication credentials or sensitive applications open simultaneously. Affected organizations should prioritize patching for employees and users with elevated access to critical web-based systems, though the user-interaction requirement and medium CVSS score mean this is not a critical emergency for most deployments.

Affected systems

Google Chrome on Android versions prior to 148.0.7778.216 are vulnerable. Desktop Chrome and Chrome on iOS are not mentioned in the advisory, suggesting they may be unaffected or were patched separately. Android users on older Chrome versions, particularly those on unmanaged personal devices, represent the primary exposure. Organizations should check Chrome version distribution in their BYOD and managed Android fleets.

Exploitability

Exploitability is moderate. An attacker must craft a malicious HTML page and convince or trick a user into visiting it—phishing, social engineering, watering-hole attacks, or malvertising are typical vectors. The attack does not require the user to grant special permissions or accept prompts beyond normal browsing. No known public exploits are tracked by CISA (KEV status is false), but the attack is straightforward enough that proof-of-concept code could emerge once the patch is widely available and researchers compare versions. The barrier to exploitation is low once an attacker has a distribution channel.

Remediation

Update Google Chrome on Android to version 148.0.7778.216 or later. Users can check their Chrome version in Settings > About Chrome, which will trigger an automatic update check. For organizations managing Android devices, deploy this patch via your EMM (Enterprise Mobility Management) solution, MDM policy, or employee communication directing users to update manually. Verify the version has incremented after the update completes, as some devices may cache older versions briefly.

Patch guidance

Google released patch version 148.0.7778.216 for Chrome on Android. Verify this version number in your environment post-update using Chrome's Settings > About Chrome panel or via MDM telemetry. If your organization uses a Chrome Enterprise policy server, confirm that the minimum version policy has been updated to reflect the patched version. For BYOD scenarios, communicate the patch urgently to users and monitor Chrome Sync data if available to estimate update compliance. No interim mitigations are available; patching is the only remediation.

Detection guidance

Monitor for anomalous WebGL activity in browser console logs or network telemetry. Look for unusual cross-origin fetch requests or XHR calls originating from unexpected frames or pop-ups, especially if they coincide with user reports of data exposure. Check for suspicious inline scripts or WebGL shader code in web traffic inspection tools. On Android devices, endpoint detection tools may flag suspicious Chrome child processes spawning WebGL rendering threads. Proactive detection is challenging; focus instead on rapid patching and user education about avoiding untrusted websites.

Why prioritize this

Prioritize this patch for users with access to sensitive web applications, financial systems, or authentication-required SaaS platforms. The cross-origin data leak risk is elevated when users maintain multiple sensitive sessions in parallel. However, the CVSS score of 4.3, lack of KEV tracking, and requirement for user interaction place this below zero-day critical patches or actively exploited vulnerabilities. It should fit into a regular monthly patch cycle rather than emergency patching, unless you have evidence of targeted attacks in your sector.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: Network-based attack vector (AV:N, low bar); low attack complexity (AC:L, no special setup required); no privilege escalation (PR:N); but critically, user interaction required (UI:R, must visit the page). Confidentiality impact is Low (C:L)—data may leak but is not wholesale theft—and no Integrity or Availability impact. The Chromium internal rating of High likely reflects the ease of exploitation and severity of cross-origin leaks from a browser-architecture perspective, but CVSS penalizes it for the user-interaction gate and limited scope. For risk prioritization, consider the user interaction requirement as a substantial mitigating factor.

Frequently asked questions