CVE-2026-19137: Critical Use after free in WebGL
CVE-2026-19137 Use after free in WebGL
Other sources
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
— NVD
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 151.0.4129.78 - Upgrade
Upgrade
Google Chrome on Androidto a version that resolves this vulnerability.Fixed in 151.0.7922.109
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-85043
- CVE-2026-102324
- CVE-2026-87499
- CVE-2026-85052
- CVE-2026-84324
- CVE-2026-103630
- CVE-2026-95372
- CVE-2026-95351
- CVE-2026-17657
- CVE-2026-91708
- CVE-2026-95339
- CVE-2026-79201
- CVE-2026-95310
- CVE-2026-95356
- CVE-2026-19173
- CVE-2026-91737
- CVE-2026-79218
- CVE-2026-84325
- CVE-2026-91722
- CVE-2026-91724
- CVE-2026-91721
- CVE-2026-79219
- CVE-2026-19170
- CVE-2026-87647
- CVE-2026-91736
- CVE-2026-87514
- CVE-2026-91716
- CVE-2026-95313
- CVE-2026-91749
- CVE-2026-84357
- CVE-2026-85051
- CVE-2026-85053
- CVE-2026-87628
- CVE-2026-17666
- CVE-2026-79195
- CVE-2026-84349
- CVE-2026-78954
- CVE-2026-79174
- CVE-2026-79187
- CVE-2026-79274
- CVE-2026-78952
- CVE-2026-79078
Frequently Asked Questions
What is the severity of CVE-2026-19137?
CVE-2026-19137 has a critical severity rating identified by Chromium security.
How do I fix CVE-2026-19137?
To fix CVE-2026-19137, update Google Chrome for Android to version 151.0.7922.109 or later.
What does CVE-2026-19137 exploit?
CVE-2026-19137 exploits a use after free vulnerability in WebGL.
What could an attacker achieve with CVE-2026-19137?
An attacker could potentially perform a sandbox escape through a crafted HTML page.
Which software is affected by CVE-2026-19137?
CVE-2026-19137 affects Google Chrome for Android prior to version 151.0.7922.109.