Mishaal Rahman / Android Authority
TL;DR
- Google is testing a new option within Android’s Advanced Protection Mode to disable the WebGPU API in Chrome to prevent security exploits.
- While WebGPU allows for high-performance rendering, it is susceptible to vulnerabilities that can lead to remote code execution.
- This change follows other recent restrictions discovered in the one-click security mode, such as limits on the AccessibilityService API.
With Android 16, Google introduced Advanced Protection Mode. This is a one-click security mode that enables all of Android’s highest security features to safeguard high-risk individuals against online attacks, harmful apps, and data risks. We’ve recently spotted Google testing restricting the AccessibilityService API unless they are classified as accessibility tools under Advanced Protection Mode. Today, we’ve spotted Google working to disable Chrome’s WebGPU API when users toggle Advanced Protection Mode.
The WebGPU API enables web developers to use the system GPU to perform high-performance computations and render complex images in the browser. WebGPU succeeds WebGL, providing better compatibility with modern GPUs, support for general-purpose GPU computations, faster operations, and access to more advanced GPU features.
WebGPU is enabled by default in Chrome 121 and later on devices running Android 12 or higher with Qualcomm or ARM GPUs. Despite the support conditions in place, this is quite a wide net, so we see WebGPU across popular devices these days.
One drawback of WebGPU is its susceptibility to attacks and vulnerabilities, which have been used for remote code execution in some cases. While vulnerabilities eventually get fixed, that usually happens only after security researchers discover them — bad actors can misuse them before disclosure to target high-risk individuals and compromise their security and privacy.
Don’t want to miss the best from Android Authority?
Google appears to be aware of WebGPU’s risks and is planning to disable it in Chrome when a user enables Advanced Protection Mode. We spotted clues within Google Play Services v26.10.31 and managed to enable a new “Turn off WebGPU to help protect against security threats” option in Advanced Protection Mode.
AssembleDebug / Android Authority
This upcoming option will join other Chrome protection features such as Android Safe Browsing, Chrome Browsing (for HTTPS), and JavaScript Protections. We’ll keep you updated when we learn more about its rollout.
⚠️ An APK teardown helps predict features that may arrive on a service in the future based on work-in-progress code. However, it is possible that such predicted features may not make it to a public release.
Thank you for being part of our community. Read our Comment Policy before posting.
