External risk intelligence

Chrome Dawn Buffer Overflow Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121156

The vulnerability exists in a web browser component (Dawn in Google Chrome) that processes content from crafted HTML pages. While it requires user interaction, modern web browsers are internet-facing applications by design, and processing untrusted content from the web is a core function, making the attack surface commonly exposed to internet-sourced threats.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Google Chrome, specifically within the Dawn component. This issue, if exploited, could allow an attacker to execute unauthorized code on a user's device by tricking them into visiting a malicious webpage. The potential for arbitrary code execution outside the browser's security sandbox is a significant concern, requiring careful assessment of our exposure.

Browser vulnerability allows unauthorized code execution.
Critical risk requires understanding our Chrome usage.
Confirm relevance and impact to our users.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted HTML page to a user, tricking them into visiting it. When the user's browser processes this page, a flaw in the Dawn component can be triggered, potentially allowing the attacker to run their own code with elevated permissions.

Requires a user to visit a malicious page.
Triggered by processing a crafted HTML page.
Risk of arbitrary code execution outside the sandbox.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability in Dawn, a component within Google Chrome, could allow attackers to execute malicious code outside the browser's security sandbox. This could occur when a user visits a specially crafted HTML page, potentially impacting the confidentiality, integrity, and availability of the affected system when supported by the advisory.

Arbitrary code execution could occur.
Malicious HTML page can trigger it.
Compromise of system integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability, a buffer overflow in Google Chrome's Dawn component, could allow for arbitrary code execution. Responsibility for remediation likely falls to teams managing the browser as an application, such as endpoint or application support teams, with input from security and platform teams for broader impact analysis. The immediate priority is to identify all systems running the affected browser version and assess their exposure and criticality to determine the urgency and scope of the remediation effort.

Determine browser ownership and scope.
Verify user interaction is required.
Plan controlled updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dawn component in Google Chrome?

Dawn is an open-source library integrated into Google Chrome that provides a cross-platform implementation of WebGPU. It acts as the bridge between web applications and the underlying graphics hardware of your computer. Developers use it to enable high-performance 3D graphics and compute tasks directly within the browser, meaning it is deeply involved in how your browser interprets and renders complex web-based visual content.

What does this CVE-2026-121156 buffer overflow mean?

This is a Heap-based Buffer Overflow (CWE-122). It happens when the Dawn component writes more data to a memory buffer than it can hold, overwriting adjacent memory. Because Dawn handles complex graphics instructions, this flaw can be manipulated to overwrite critical system data, effectively tricking the browser into executing arbitrary instructions provided by an attacker instead of performing its intended graphics task.

How is the buffer overflow triggered?

The vulnerability is triggered when a user visits a malicious website containing a specially crafted HTML page. The browser's Dawn component attempts to process the malicious graphics code embedded in the page, leading to the memory error. Simply viewing legitimate websites or using the browser for standard tasks without encountering this specific malicious content will not trigger the bug.

Do I need to worry about this if I use Chrome?

Yes, if you use Chrome on an internet-connected device. Halo Surface Signal identifies this as a 'Likely' risk because browsers are inherently designed to process untrusted content from the web. Since the vulnerability allows code execution outside the browser's security sandbox, any system running an affected version and accessing the internet is exposed to this potential threat.

When should I update my browser to fix this?

You should prioritize updating Chrome to version 157.0.8103.38 or higher immediately. Since this involves a critical sandbox-escape vulnerability, the primary defense is to apply the vendor-provided patch. Verify your current version, coordinate with your IT or application management teams, and ensure the update is deployed across all endpoint devices to close the security gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.