Vulnerability intelligence

CVE-2026-103628

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

CVSS Score

9.6

Critical

EPSS — Exploit Probability

—

Awaiting FIRST.org data · checked 2026-10-02

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

1 article across 1 outlet · first covered Oct 2, 2026 · latest Oct 2, 2026

Coverage timeline

Chrome Update Fixes Critical WebGL Flaw Enabling Sandbox Escape
securityonline.info · Oct 2, 2026

Related CVEs — Google

CVE-2026-103631 CVE-2026-103625 CVE-2026-103622 CVE-2026-103626 CVE-2026-102331 CVE-2026-85046KEV CVE-2026-87491KEV CVE-2026-49881