Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
🆕 New CVEs Google Chrome 156.0.8078.47 fixes 2 high-severity CVEs Worst: remote code execution in WebGL via out-of-bounds write (CVE-2026-120931) Patch → 156.0.8078.47 https://cve.now/CVE-2026-120931?release=CVE-2026-120930&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
🚨 CVE-2026-120931 (CVSS 9.6 Critical) An out-of-bounds write in Google Chrome WebGL on Android allows remote attackers to execute code outside the sandbox via a crafted HTML page. ⚡ Action: Update Chrome on Android to >= 156.0.8078.47. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120931/ https://t.co/RzJJsDf3TH
Chrome on Android: CVSS 9.6 WebGL bug runs code outside sandbox 1. CVE-2026-120931: out-of-bounds write in WebGL. 2. A crafted HTML page lets a remote attacker execute code outside the sandbox. 3. Fixed in 156.0.8078.47. Update now. 4. CVSS 3.1 9.6 (CNA), Chromium severity Critical. Exploitation not stated. https://nvd.nist.gov/vuln/detail/CVE-2026-120931 #Chrome #CVE
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | android | - | - | - | |
| App | chrome | - | - | - |