Description

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-02T00:18:28.217Z",
  "pubdate": "2026-09-02T00:18:28.217Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the Dawn component of Google Chrome on Android. This memory corruption flaw permits a remote attacker to achieve arbitrary code execution outside the confines of the browser sandbox by enticing a user to visit a maliciously crafted HTML page. The vulnerability is classified with a 'High' severity, reflecting its potential for significant system compromise. By leveraging the UAF condition, an attacker can manipulate memory to hijack control flow, effectively bypassing browser security boundaries. Successful exploitation necessitates user interaction—specifically navigating to a compromised or malicious web resource—but does not require prior authentication or elevated privileges from the victim. Given that this vulnerability allows for sandbox escape, the risk implications are severe, potentially leading to unauthorized data access, arbitrary binary execution, and full compromise of the affected Android device's browser context.",
  "technicalDetails": "The vulnerability resides within the Dawn component of the Chromium browser engine, which provides a cross-platform implementation of the WebGPU standard. The root cause is a Use-After-Free (UAF) memory corruption bug, occurring when the browser engine attempts to access a memory resource that has been previously deallocated. In the context of Dawn, improper management of object lifecycles—specifically within the GPU command processing pipeline or resource synchronization logic—leads to a dangling pointer condition.\nThe attack flow commences when a remote attacker hosts a specially crafted HTML page containing malicious WebGPU calls or specific JavaScript sequences designed to trigger the vulnerable code path in Dawn. Upon the browser rendering this page, the internal engine creates a reference to a memory object, which is subsequently freed prematurely due to a logic flaw in the memory management subsystem. If the attacker succeeds in 'spraying' the heap or carefully timing memory allocation, they can reoccupy the memory slot previously held by the freed object with attacker-controlled data.\nOnce the attacker successfully achieves control over the memory layout, the subsequent use of the dangling pointer allows for the execution of arbitrary instructions. Because this occurs within the context of the renderer process, the attacker must overcome or exploit the browser's sandbox protections to achieve full system-level impact. In this specific scenario, the vulnerability allows for code execution outside the sandbox, suggesting that the memory corruption leads to an effective escape from the renderer's restricted execution environment.\nThe vulnerability affects Google Chrome for Android versions prior to 152.0.7977.75. The exploitation is remote, requiring only that the victim navigate to the malicious page, triggering the vulnerable path during the interaction between the rendering engine and the Dawn subsystem. There are no authentication requirements, as the vulnerability is triggered by the browser's standard parsing and rendering processes of web content. The payload behavior involves executing shellcode or arbitrary commands with the privileges of the browser process, potentially leading to persistent access, information exfiltration, or complete host control, depending on the success of the sandbox escape mechanism utilized after the initial memory corruption is achieved."
}