EUVD-2026-33184
GHSA-gf8f-g97g-h982
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read and write in Dawn in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker to break out of the renderer sandbox by serving a crafted HTML page that triggers an out-of-bounds read and write in the Dawn WebGPU implementation. Chromium rates the underlying issue as Critical severity, and CVSS 8.3 with scope change reflects the cross-boundary impact, though EPSS is low at 0.03% and no public exploit has been identified at time of analysis.
Technical ContextAI
Dawn is Chromium's open-source implementation of the WebGPU API, providing GPU acceleration for web content by translating WebGPU calls into native graphics backends (Vulkan, Metal, D3D12). Because Dawn parses and dispatches GPU commands originating from untrusted JavaScript in the renderer, memory-safety defects in its command validation or buffer handling can be reached directly from a web page. The root cause class is CWE-125 (out-of-bounds read) combined with an out-of-bounds write, which in the context of a GPU process - a higher-privileged broker than the renderer - enables escape from the renderer sandbox (CVSS scope-changed). The affected product per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with the description specifically scoping the impact to the Android build.
RemediationAI
Vendor-released patch: Google Chrome for Android 148.0.7778.216 - update via the Google Play Store or managed Android update channel, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. For managed fleets, push the update through Android Enterprise / MDM and verify the version post-rollout. As a compensating control until devices are patched, disable WebGPU via the chrome://flags '#enable-unsafe-webgpu' and '#enable-webgpu-developer-features' settings or an enterprise policy that prevents WebGPU usage; the trade-off is loss of GPU-accelerated web features (3D content, ML inference in the browser) but Dawn is the specific attack surface and disabling it removes the exposed code path. Restricting web browsing to trusted sites via mobile content filtering reduces the chance of encountering a malicious crafted HTML page, at the cost of normal browsing utility.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today