Google Chrome EUVD-2026-61224

Exploitation requires the victim to open an attacker-controlled HTML page in a vulnerable Google Chrome for Android build (before 151.0.7922.169) that reaches the Dawn/WebGPU code path - user interaction (UI:R) in the form of visiting the page is the one mandatory prerequisite, but no authentication (PR:N) and no unusual configuration are needed, and WebGPU is reachable from ordinary web content by default. Limiting factors: the target must be on an unpatched version, must actually load the malicious page, and impact is scoped to the Android platform per the description; there is no indication of automated/wormable exploitation and no confirmed in-the-wild use, so realistic risk depends on drive-by delivery to unpatched devices.

This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) describes network-reachable, low-complexity, unauthenticated exploitation needing only that a victim open a page, and the scope change reflects a sandbox escape, which is the most severe outcome class for a browser bug. Weighing the signals: EPSS and SSVC data were not provided, and there is no CISA KEV listing and no referenced proof-of-concept, so there is currently no public exploit identified at time of analysis and no confirmation of in-the-wild use. However, browser sandbox-escape RCEs in a ubiquitous product are routinely reverse-engineered from the patch, so the practical exploitation window opens quickly once the fix ships; any operator running unmanaged or slow-updating Chrome-on-Android fleets should treat this as urgent and verify auto-update completion rather than assume coverage. The main uncertainty is that no EPSS/KEV/SSVC values were supplied to quantify real-world exploitation probability, so prioritization here rests on the CVSS profile and the sandbox-escape nature of the bug.

An attacker hosts a malicious web page containing crafted WebGPU/Dawn operations and drives a victim to it via a link, ad, or compromised site. When the victim opens the page in a vulnerable Chrome-on-Android build, the crafted content triggers the heap buffer overflow in Dawn and executes attacker code outside the renderer sandbox, compromising the browser context on the device. No public proof-of-concept has been identified at time of analysis; the low attack complexity means only a single page visit (UI:R) is required.