Description

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-18T21:18:27.617Z",
  "pubdate": "2026-08-18T21:18:27.617Z",
  "executiveSummary": "A critical buffer overflow vulnerability has been identified in the Dawn component of Google Chrome on Android prior to version 151.0.7922.169.\nThe vulnerability allows a remote attacker to execute arbitrary code outside the established browser sandbox security boundaries.\nExploitation requires a user to visit or interact with a maliciously crafted HTML page, presenting severe risks including arbitrary code execution, potential device compromise, and complete bypass of Chromium sandbox mitigations.\nDue to the remote attack vector and the potential for sandbox escape, the severity is classified as Critical, necessitating immediate remediation across affected Android deployments.",
  "technicalDetails": "The root cause of the vulnerability stems from a buffer overflow condition within the Dawn graphics/compute subsystem integrated into Google Chrome on Android.\nDawn, which acts as an implementation of WebGPU primitives, fails to perform adequate bounds checking and memory validation when processing untrusted input derived from web content.\nThe attack vector is network-based, specifically triggered when a victim renders a crafted HTML page containing malicious WebGPU or Dawn instructions.\nUpon parsing the malformed input, memory corruption occurs in the heap space managed by the vulnerable component, allowing the remote attacker to overwrite adjacent memory structures.\nBy meticulously engineering the heap layout and payload, the threat actor can achieve arbitrary code execution on the host operating system.\nCrucially, the exploitation of this buffer overflow successfully breaches the Chromium sandbox isolation layer, enabling the attacker to execute code with the broader privileges of the browser application process on Android.\nThe affected product is Google Chrome on Android, specifically targeting versions prior to 151.0.7922.169.\nNo prior authentication or elevated privileges are required by the attacker, as interaction is initiated purely via web content exposure."
}