Description
Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-11-03
Score: 9.6 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Buffer overflow in the Dawn graphics engine of Google Chrome on Android devices before version 157.0.8103.38 allows a crafted HTML page to exploit a memory corruption bug. The flaw permits an attacker to execute arbitrary code with privileges beyond the browser sandbox, potentially compromising the entire device. The vulnerability is classified as critical.

Affected Systems

Google Chrome for Android, any installation with a suspended Dawn engine version earlier than 157.0.8103.38.

Risk and Exploitability

Because the issue is a buffer overflow, exploitation requires a malicious HTML page that can be served remotely. The exact CVSS score is not disclosed, but the severity is labeled critical by Chromium, and the EPSS score is unknown. The vulnerability is not currently listed in CISA's KEV catalog. An attacker would need to convince a user to visit a hostile site or supply a compromised webpage from a network-controlled source.

Generated by OpenCVE AI on November 3, 2026 at 23:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 157.0.8103.38 or later on Android devices
  • If an update is not immediately available, uninstall and reinstall the latest Chrome package from the Google Play Store to ensure the security fix is applied
  • Restrict or monitor access to untrusted web content by using network filtering or browser security settings to block potentially malicious HTML pages until the patch is applied

Generated by OpenCVE AI on November 3, 2026 at 23:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Chrome Dawn Enables Remote Code Execution on Android

Tue, 03 Nov 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Tue, 03 Nov 2026 20:45:00 +0000

Type Values Removed Values Added
Description Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-122
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-11-03T21:32:12.141Z

Reserved: 2026-11-03T10:34:31.284Z

Link: CVE-2026-121247

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-03T21:17:35.220

Modified: 2026-11-03T22:19:45.317

Link: CVE-2026-121247

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T23:30:06Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow