Critical · 9.6 CVE-2026-120931 EUVD-2026-116384GHSA-33qj-632f-3294

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outs…

Published Nov 3, 2026 · Updated Nov 5, 2026 · Assigned by Chrome

Vendor: Google Product: Chrome Package: chromium Category: Browsers Ecosystem: Debian

Description

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Affected products

Vendor	Product	Affected	Fixed
Google	Chrome	156.0.8078.47 – < 156.0.8078.47	156.0.8078.47

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	chromium	156.0.8078.47-1	—
Debian 13	chromium	156.0.8078.47-1~deb13u1	—
Debian 12	chromium	156.0.8078.47-1~deb12u1	—