Chrome WebGL Has Another Critical RCE — CVE-2026-93372 Hits Android and Desktop

• The Mess: Google patched a critical WebGL buffer overflow in Chrome that can lead to arbitrary code execution from a crafted HTML page. The bug sits in a browser component designed to process attacker-controlled graphics data.
• The Damage: A malicious webpage can turn a normal browser visit into a code-execution attack without requiring credentials.
• The Fix: Update Chrome to 153.0.8010.52 or later immediately.

Chrome just patched another graphics-processing bug with a familiar security outcome:

remote code execution.

The vulnerability is tracked as CVE-2026-93372 and was disclosed on September 17, 2026. Google classified it as Critical.

The bug is a buffer overflow in WebGL.

According to the CVE description, a remote attacker can potentially execute arbitrary code outside Chrome’s sandbox through a specially crafted HTML page.

That is exactly the sort of browser vulnerability attackers like.

No server needs to be compromised first.

No credentials need to be stolen.

The victim only needs to load malicious content.

The vulnerable component is WebGL

WebGL allows web applications to use GPU-accelerated graphics through the browser.

That means a webpage can submit complex graphics workloads to Chrome without installing native software.

It’s also a huge attack surface.

The browser has to translate web-controlled input into operations handled by graphics libraries, GPU interfaces and rendering infrastructure.

CVE-2026-93372 is a buffer overflow in that processing path.

The public CVE metadata maps it to CWE-121 — Stack-based Buffer Overflow in the current record.

The exact vulnerable function and exploitation primitive remain restricted by Chromium.

Google explicitly notes that details of security bugs can remain unavailable until a sufficient percentage of users have received the fix.

That restriction is deliberate.

Publishing the vulnerable code path before users update would hand attackers a much better starting point for exploit development.

The attack starts with HTML

The published description gives us an important detail:

crafted HTML page.

That means the attacker doesn’t need to directly send a malicious binary to the victim.

The delivery mechanism can be ordinary web content.

Think:

malicious page → WebGL input → vulnerable Chrome code → memory corruption → code execution

The victim doesn’t need to download an executable.

They don’t need to open a ZIP file.

They don’t need to install a browser extension.

The browser itself processes the hostile input.

That’s why browser memory-safety vulnerabilities remain such a persistent problem.

The CVSS vector is nasty

Current vulnerability databases reproduce the following CVSS 3.1 vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The important fields are:

• AV:N — remotely exploitable;
• AC:L — low complexity;
• PR:N — no privileges required;
• UI:R — user interaction required;
• C:H — high confidentiality impact;
• I:H — high integrity impact;
• A:H — high availability impact.

The user interaction requirement matters.

This is not an Internet worm that automatically compromises every vulnerable Chrome installation.

The victim has to interact with the malicious content.

But opening a webpage is an extremely normal browser operation.

That makes UI:R far less reassuring than it might look in a server vulnerability.

“Outside the sandbox” is the important phrase

Chrome uses multiple security boundaries.

The browser sandbox is one of them.

Memory corruption inside a renderer process does not automatically mean the attacker owns the entire operating system.

The attacker generally needs to move through additional security boundaries.

But CVE-2026-93372 is explicitly described as potentially allowing arbitrary code execution outside the sandbox.

That dramatically changes the impact.

A browser exploit that crashes a renderer is one thing.

A vulnerability that provides a route to native code execution beyond the sandbox is another.

The exact exploitation chain is not public yet, so Bugstoday isn’t going to manufacture a fake sandbox-escape primitive.

The documented result is enough:

crafted web content can potentially reach arbitrary code execution outside the sandbox.

Android is explicitly affected

The CVE records specifically describe Chrome on Android before 153.0.8010.52 as affected.

Google’s Chrome release notes also state that the Android release contains the corresponding desktop security fixes unless otherwise noted.

On September 17, Google released Chrome 153.0.8010.52 for Android and Chrome 153.0.8010.52/.53 for Windows and macOS, with Linux receiving 153.0.8010.52.

That makes this a cross-platform patching issue rather than an Android-only curiosity.

If you manage endpoints centrally, check every Chrome installation rather than assuming that mobile devices are the only systems requiring attention.

And WebGL isn’t the only critical graphics problem

Here’s the part that makes the September Chrome release particularly interesting.

CVE-2026-93372 wasn’t patched alone.

The same September 17 stable release also fixed:

CVE-2026-93374 — Use after free in Dawn

Google rated that vulnerability Critical as well.

The CVE description says a remote attacker can potentially execute arbitrary code outside the sandbox through a crafted HTML page on affected Android Chrome versions.

So administrators shouldn’t deploy a narrow “WebGL fix.”

The correct response is to update Chrome itself.

The browser release contains multiple security fixes.

Chrome 153 already had a huge security wave

Chrome 153 has been receiving a large sequence of security fixes.

The September 8 stable release alone contained 230 security fixes, including multiple critical WebGL vulnerabilities such as:

• CVE-2026-87464;
• CVE-2026-87488;
• CVE-2026-87438;
• CVE-2026-87527.

Then September 17 brought another set of fixes, including CVE-2026-93372 and CVE-2026-93374.

This isn’t evidence that Chrome suddenly became uniquely insecure.

It demonstrates something more interesting:

WebGL and GPU-facing browser code remain a dense memory-safety attack surface.

The browser is effectively processing hostile graphics programs supplied by arbitrary websites.

That’s a difficult security boundary to get perfect.

No public exploit yet

Current vulnerability tracking does not show CVE-2026-93372 in CISA KEV and does not identify a public exploit as of the disclosure reviewed for this article.

That is the current status.

It should not be confused with “not exploitable.”

Google itself is withholding technical details while the update rolls out.

That is a classic race:

Google patches → defenders update → researchers analyze the patch → exploit developers compare vulnerable/fixed code.

Once enough users have updated, additional technical information may become public.

Why browser patching is different

With a server vulnerability, administrators can often identify the exposed service.

With Chrome, the vulnerable application may be running on:

• employee laptops;
• developer workstations;
• jump boxes;
• VDI environments;
• shared terminals;
• Android phones;
• tablets;
• unmanaged BYOD devices.

The attack surface moves with the user.

That means patch management needs endpoint coverage.

Checking one Windows image isn’t enough.

What enterprises should check

For managed Chrome deployments, verify:

Browser version

Confirm systems are running at least:

153.0.8010.52

or the appropriate newer build.

Android deployment

Don’t assume Google Play updates have reached every device simultaneously.

Linux

Check package-managed Chromium/Chrome installations separately.

VDI

A golden image that still contains an older Chrome version can recreate the vulnerability across an entire virtual desktop fleet.

Extensions

Extensions aren’t the vulnerability here, but browser compromise can potentially expose information available to the browser session.

Review high-risk extensions separately.

What normal users should do

This one is boring.

That’s good.

Open Chrome.

Go to:

Help → About Google Chrome

Let Chrome check for updates.

Restart the browser.

Check the version again.

If the browser is managed by an organization, the user may not control the update mechanism. In that case, the relevant team needs to push the current build.

Do not wait for an exploit headline.

Can disabling WebGL be the emergency workaround?

Technically, reducing WebGL exposure can reduce the attack surface.

Operationally, it’s messy.

Modern websites and applications can rely on WebGL for legitimate graphics functionality.

A blanket WebGL disablement can break applications without providing a clean enterprise-wide security strategy.

For most environments, the better mitigation is straightforward:

patch Chrome.

If patching is temporarily impossible on a high-risk system, additional browser hardening and restricted web access may reduce exposure, but those are compensating controls rather than a replacement for the vendor update.

What defenders should hunt for

There is no public CVE-specific detection signature that can reliably identify exploitation from the current technical disclosure.

Instead, monitor for suspicious browser behavior around affected endpoints.

Potential indicators include:

• Chrome crashes immediately after visiting unusual websites;
• unexpected Chrome child processes;
• browser processes spawning abnormal executables;
• suspicious outbound connections following browser activity;
• unexpected persistence mechanisms;
• newly created files from browser processes;
• unusual credential-access activity;
• endpoint security alerts involving Chrome renderer processes.

None of these individually proves CVE-2026-93372 exploitation.

They are investigation triggers.

The exploit-development problem

The interesting question isn’t whether WebGL can theoretically be exploited.

Memory corruption bugs have a long history of exploitation.

The interesting question is whether this particular overflow can be converted into a reliable primitive.

That depends on details Google hasn’t published:

• exact buffer type;
• controllable length;
• allocation layout;
• overwrite target;
• renderer process state;
• mitigations;
• architecture;
• sandbox boundaries;
• GPU process interaction;
• available information leaks.

Until those details are public, claims about a one-click full-device compromise would be speculation.

The documented security impact is already severe enough without it.

Bugstoday’s take

CVE-2026-93372 is another reminder that the browser isn’t just a document viewer.

WebGL turns arbitrary website content into input for complicated native graphics infrastructure.

That’s an enormous attack surface.

Google patched the overflow in Chrome 153.0.8010.52 and deliberately kept technical details restricted while the update rolls out.

There is no confirmed public exploit in the sources reviewed.

Good.

Keep it that way.

Update Chrome before somebody turns the patch diff into a working exploit.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

• Google Chrome Releases — Stable Channel Update for Desktop, September 17, 2026.
• Google Chrome Releases — Chrome for Android Update, September 17, 2026.
• Chromium Issue Tracker — issue 548085797.
• MITRE/CVE — CVE-2026-93372.
• NVD — CVE-2026-93372.