PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9929 Google CVE debrief

A high-severity inappropriate implementation vulnerability in WebGL on Google Chrome for Android prior to version 148.0.7778.216 enables remote attackers to leak cross-origin data through a crafted HTML page. The flaw stems from improper handling of WebGL operations that violate same-origin policy protections. This vulnerability was disclosed by Google on May 28, 2026, with an update issued the following day. Organizations should prioritize updating Chrome on Android devices to version 148.0.7778.216 or later.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-07-21
Advisory published
2026-05-28
Advisory updated
2026-07-21

Who should care

Organizations with Android device fleets, mobile application developers using WebGL, security teams managing browser security policies, and users handling sensitive cross-origin data in web applications.

Technical summary

This vulnerability exists in the WebGL implementation of Google Chrome on Android versions prior to 148.0.7778.216. The inappropriate implementation allows a remote attacker to bypass same-origin policy protections and extract cross-origin data by manipulating WebGL operations through a maliciously crafted HTML page. WebGL (Web Graphics Library) provides JavaScript APIs for rendering interactive 2D and 3D graphics, and improper isolation between origins in its implementation can enable information disclosure attacks. The attack vector requires user interaction with the crafted page, but no local access or elevated privileges are needed.

Defensive priority

high

Recommended defensive actions

  • Update Google Chrome on Android devices to version 148.0.7778.216 or later
  • Verify Chrome version through Settings > About Chrome
  • Enable automatic updates for Chrome on managed Android devices
  • Review browser security settings and same-origin policy configurations
  • Monitor for unusual cross-origin data access attempts in application logs

Evidence notes

The CVE description identifies this as an inappropriate implementation in WebGL affecting Chrome on Android, with a High severity rating per Chromium security classification. The vulnerability was published to NVD on May 28, 2026, and modified on May 29, 2026. Google released the stable channel update addressing this issue on May 28, 2026.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9929 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9929

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9929 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9929

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.