Google Chrome: Out-of-bounds write in WebGL allows code execution
Summary
Google Chrome desktop versions before 154.0.8037.97 contain an out-of-bounds write in the WebGL component (CVE-2026-103628, CWE-787, CVSS 9.6 Critical). A remote attacker can run arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. No login is required, but the victim must open the page.
Affected
- Google Chrome desktop builds (Windows, macOS, Linux) prior to 154.0.8037.97
- Chromium-based browsers and Linux distribution packages: versions unknown from the sources reviewed
Fixed in
- Google Chrome 154.0.8037.97 (Linux); 154.0.8037.97 or .98 (Windows, macOS), according to secondary reports of the vendor release
- Current stable channel is newer (Chrome 155 and 156 are released); install the latest stable version
- Debian chromium: 155.0.8059.39-1~deb12u1
- Ubuntu chromium-browser is a wrapper; check the version of the installed Chromium snap
Workaround
- No vendor workaround known. Updating is the only confirmed fix.
- Do not disable WebGL without checking with the vendor or application owners first.
Exploitation
- In the wild: no evidence known. CISA SSVC lists exploitation as none and automatable as no. Not in the CISA KEV catalog.
- Public proof of concept: none known from the sources reviewed.
- Technical details of the triggering WebGL calls are not public in the official record.
Our recommendation
- Update Google Chrome on all endpoints to the current stable release and verify the version on each device, including unmanaged devices and kiosks.
- Make sure the browser is restarted (Relaunch) after the update, because the fix only applies after a restart.
- Check that automatic updates are working.
- Update Linux chromium packages and Chromium-based browsers (Edge, Brave, Opera) through their vendors.
- Prioritise this update within your normal critical-update timeline, as the drive-by delivery method makes it relevant for all browsing users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- Ubuntu Security: CVE-2026-103628 ubuntu.com
- OSV: Debian CVE-2026-103628 osv.dev
- OpenCVE: CVE-2026-103628 app.opencve.io
- SUSE CVE: CVE-2026-103628 vulners.com
- SecurityOnline: Chrome 154 security update securityonline.info
- GHacks: Chrome 155 release www.ghacks.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:27.
Original description (NVD)
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.