CVE-2026-84352: 
vulnerability analysis and mitigation

CVE-2026-84352 is a use-after-free vulnerability in WebGL in Google Chrome on Android that allows a remote attacker to execute arbitrary code outside the browser sandbox via a crafted HTML page. It was reported internally by Google on August 14, 2026, and publicly disclosed on September 2, 2026, as part of Chrome's stable channel update to version 152.0.7977.75. All Chrome for Android versions prior to 152.0.7977.75 are affected. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) (Chrome Releases, GitHub Advisory).

The vulnerability is classified as CWE-416 (Use After Free), occurring in Chrome's WebGL implementation on Android. A use-after-free condition arises when memory associated with a WebGL object is freed but a dangling pointer to that memory is subsequently accessed, allowing an attacker to control the freed memory region and redirect execution flow. Exploitation requires a user to visit a specially crafted HTML page, at which point the attacker can trigger the memory corruption to achieve code execution outside the Chrome sandbox — a sandbox escape. The vulnerability was tracked internally under Chromium issue 546260492 (Chrome Releases, GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary code outside the Chrome sandbox on affected Android devices, effectively achieving a full sandbox escape. This grants the attacker the ability to run code with the privileges of the Chrome process, potentially enabling access to sensitive data stored on the device, installation of malware, or further lateral movement within the device's environment. The impact spans confidentiality, integrity, and availability — all rated High in the CVSS scoring (GitHub Advisory, Chrome Releases).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability was discovered and reported internally by Google, suggesting it was not exploited before patching. The EPSS score is approximately 0.277–0.313%, placing it in the lower percentiles for near-term exploitation likelihood. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Identify Android users running Google Chrome versions prior to 152.0.7977.75, which can be inferred from browser User-Agent strings or targeted delivery to Android platforms.
2. Craft malicious HTML page: Develop a specially crafted HTML page containing malicious WebGL JavaScript code designed to trigger the use-after-free condition in Chrome's WebGL implementation — for example, by allocating a WebGL object, freeing it, and then accessing it through a dangling reference.
3. Deliver the payload: Host the malicious page on an attacker-controlled server or distribute it via phishing emails, malicious ads, or compromised websites to lure Android Chrome users into visiting it.
4. Trigger the vulnerability: When the victim visits the page on an affected Android Chrome instance, the WebGL use-after-free is triggered, corrupting heap memory.
5. Achieve sandbox escape and code execution: By controlling the freed memory region (e.g., via heap grooming techniques), the attacker redirects execution flow to attacker-controlled code, escaping the Chrome sandbox and executing arbitrary code on the device (Chrome Releases, GitHub Advisory).

• Network: Unexpected outbound connections from a Chrome process on Android to unknown or suspicious IP addresses/domains following a web page visit; HTTP requests to newly registered or low-reputation domains serving WebGL-heavy content.
• Process: Unusual child processes spawned by the Chrome browser process on Android; unexpected application installations or permission grants following browser activity.
• Logs: Android system logs showing Chrome process crashes or abnormal memory access patterns (e.g., SIGSEGV or heap corruption signals) prior to unexpected behavior; WebGL-related errors in Chrome's internal logs.
• File System: Unexpected files written to storage by the Chrome process; new APKs or executables appearing in download directories without user initiation.

Google has released Chrome version 152.0.7977.75 for Android (and 152.0.7977.75/.76 for Windows/Mac/Linux) which addresses this vulnerability. Users should immediately update Google Chrome on all Android devices to version 152.0.7977.75 or later via the Google Play Store. Organizations should enforce automatic browser updates through MDM policies. As a temporary measure, restricting access to untrusted or unknown websites and implementing network-level content filtering can reduce exposure until the patch is applied (Chrome Releases, GitHub Advisory).

The September 2026 Chrome stable update, which included CVE-2026-84352 among 26 security fixes (two rated Critical), received broad coverage from security media outlets including SecurityWeek, CyberSecurityNews, GBHackers, and Malwarebytes, with several noting the significance of the two critical use-after-free sandbox escape flaws (SecurityWeek, Malwarebytes). The CIS also issued an advisory noting that multiple vulnerabilities in Google Chrome could allow for arbitrary code execution (CIS Advisory). Community sentiment on Reddit and security forums reflected urgency around patching, particularly given the sandbox escape potential of the two critical flaws.