Description
Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Published: 2026-08-18
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow occurs in the Dawn rendering engine of Google Chrome on Android devices before version 151.0.7922.169. By delivering a specially crafted HTML page, a remote attacker can cause the overflow, which allows execution of arbitrary code outside of the browser sandbox. This can compromise the confidentiality, integrity, and availability of the affected device.

Affected Systems

The vulnerability affects Google Chrome on Android running any build earlier than 151.0.7922.169. All Android devices that ship with Chrome versions prior to that release are impacted.

Risk and Exploitability

The flaw is scored as 9.6 on CVSS with an EPSS of < 1 %, indicating a high severity but a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The description states that a remote attacker can trigger the overflow via a crafted HTML page delivered over the network, implying that malicious or compromised websites may be the primary attack vector. Once the Chrome update is installed, the risk is effectively eliminated.

Generated by OpenCVE AI on August 21, 2026 at 17:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 151.0.7922.169 or newer on all Android devices.
  • Enable automatic updates for Chrome to ensure future patches are applied promptly.
  • If an update cannot be performed immediately, restrict access to potentially malicious sites or apply network‑level filtering until the update is applied.

Generated by OpenCVE AI on August 21, 2026 at 17:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4749-1 chromium security update
Debian DSA Debian DSA DSA-6455-1 chromium security update
History

Thu, 20 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 19 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Wed, 19 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Chrome Dawn Allows Remote Code Execution on Android chromium-browser: Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
Weaknesses CWE-120
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important

Tue, 18 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 18 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Buffer Overflow in Chrome Dawn Allows Remote Code Execution on Android

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
Weaknesses CWE-122
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-20T03:55:40.271Z

Reserved: 2026-08-18T19:44:50.257Z

Link: CVE-2026-76036

cve-icon Vulnrichment

Updated: 2026-08-19T11:30:08.703Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:27.617

Modified: 2026-08-20T19:27:12.977

Link: CVE-2026-76036

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-18T20:31:24Z

Links: CVE-2026-76036 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T18:00:16Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-122

    Heap-based Buffer Overflow