EUVD-2026-69736
GHSA-59vv-93jw-8wmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage issues malicious WebGPU/Dawn calls
-
ExploitTrigger use-after-free in Dawn
-
ExecutionGroom reclaimed memory for control
-
PersistExecute arbitrary code outside sandbox
-
ImpactCompromise Android device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in a vulnerable Google Chrome build (< 152.0.7977.75) on Android - this is the UI:R user interaction that limits the attack. No authentication is required (PR:N) and no non-default setting is named in the description; WebGPU/Dawn is the reachable component, so environments that have disabled WebGPU would not be exposed. The limiting factors are the required page visit and the specific vulnerable version/platform (Chrome on Android); successful reliable exploitation additionally depends on defeating memory-hardening mitigations to achieve the claimed out-of-sandbox execution. |
| Impact | The signals are consistent and point to genuine priority: CVSS 3.1 9.6 with AV:N/AC:L/PR:N/UI:R/S:C and C:H/I:H/A:H indicates a network-reachable, low-complexity, unauthenticated bug needing only a page visit, with a scope change reflecting the claimed sandbox escape. Google rated the Chromium severity 'High'. Working against widespread exploitation: no EPSS score, POC, or KEV entry is present in the data, so there is no evidence of active exploitation yet - memory-corruption browser bugs typically require substantial exploit development, and full sandbox escapes especially so. One point warranting verification: the description states code execution 'outside the sandbox,' which is unusually strong for a single Dawn UAF (many GPU-process bugs execute inside a sandboxed process); the S:C scope change is consistent with that claim but the escape breadth should be confirmed against the vendor advisory. Treat as a high-priority patch on exposure/impact grounds despite the absence of exploitation telemetry. |
| Exploit ScenarioDerived | An attacker hosts or injects a malicious HTML page that issues crafted WebGPU calls to trigger the Dawn use-after-free; a victim running a vulnerable Chrome on Android simply visits the page (e.g., via a link, ad, or compromised site). The corrupted memory is leveraged to execute attacker code, per the advisory outside the renderer sandbox, compromising the device. No public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Remote code execution in Google Chrome for Android before 152.0.7977.75 stems from a use-after-free in Dawn, Chrome's WebGPU/GPU graphics abstraction layer, and - per Google's advisory - allows a crafted HTML page to execute arbitrary code outside the renderer sandbox. Exploitation only requires an unauthenticated victim to visit a malicious page, giving the attacker high-impact code execution on the device. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, though the sandbox-escape framing makes it a high-priority browser patch.
RemediationAI
Update Google Chrome to 152.0.7977.75 or later (Vendor-released patch: 152.0.7977.75); on Android this arrives through the Google Play Store, so ensure automatic app updates are enabled and force-update managed fleets via MDM. Because the flaw is reachable from any crafted web page, there is no clean feature-level workaround short of patching; interim risk can be reduced by disabling the WebGPU/'Unsafe WebGPU' path (e.g., via chrome://flags or enterprise policy where supported) to remove the Dawn attack surface, at the cost of breaking WebGPU-based sites, and by restricting browsing to trusted sites - neither substitutes for the update. Consult Google's advisory at http://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html and the tracker issue https://issues.chromium.org/issues/549311485 for confirmation once access is opened.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dawn is the open-source implementation backing the WebGPU API in Chromium, translating web-exposed GPU commands into native Metal/Vulkan/D3D calls; it runs partly in the GPU process. The root cause is CWE-416 (Use After Free): an object is freed while a reference to it remains live, so a subsequent access operates on reclaimed/attacker-groomed memory, enabling controlled corruption. Because WebGPU is reachable directly from untrusted JavaScript/HTML, a web page can drive the vulnerable code path without any plugins or extensions. The reference https://issues.chromium.org/issues/549311485 is the (access-restricted) Chromium tracker entry, and the fix shipped in the Chrome Stable channel release 152.0.7977.75.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable via a web page (AV:N/AC:L/PR:N) requiring a victim visit (UI:R); sandbox escape justifies S:C with full C:H/I:H/A:H on the host, matching the vendor vector.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for Android versions before 152.0.7977.75 contain a critical use-after-free vulnerability in the Dawn graphics layer that enables remote code execution with complete sandbox escape when users visit a malicious webpage, requiring no authentication. The sandbox breach is particularly severe as it defeats Chrome's primary security boundary, giving attackers unrestricted access to device resources, user data, and underlying operating system capabilities. Organizations managing Android devices face elevated risk of device compromise, credential theft, and lateral network access without immediate patch deployment.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 152 Memory Safety and Authorization Flaws
View all 26Same weakness CWE-416 – Use After Free
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB