EUVD-2026-61224
GHSA-prwg-9cxf-w9vj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a visit (AV:N/AC:L/PR:N/UI:R); Dawn code executing outside the sandbox justifies S:C with full C/I/A loss.
Primary rating from Vendor (google).
CVSS VectorVendor: google
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an attacker-controlled HTML page in a vulnerable Google Chrome for Android build (before 151.0.7922.169) that reaches the Dawn/WebGPU code path - user interaction (UI:R) in the form of visiting the page is the one mandatory prerequisite, but no authentication (PR:N) and no unusual configuration are needed, and WebGPU is reachable from ordinary web content by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes network-reachable, low-complexity, unauthenticated exploitation needing only that a victim open a page, and the scope change reflects a sandbox escape, which is the most severe outcome class for a browser bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious web page containing crafted WebGPU/Dawn operations and drives a victim to it via a link, ad, or compromised site. When the victim opens the page in a vulnerable Chrome-on-Android build, the crafted content triggers the heap buffer overflow in Dawn and executes attacker code outside the renderer sandbox, compromising the browser context on the device. … |
| Remediation | Vendor-released patch: update Google Chrome to 151.0.7922.169 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert all users and IT staff that Chrome for Android versions before 151.0.7922.169 require emergency update and distribute guidance to install version 151.0.7922.169 or later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today