External risk intelligence

Google Chrome for Android Buffer Overflow Allows Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121247

This vulnerability affects the Dawn component within a web browser client. The attack requires a user to navigate to a crafted HTML page, making it a client-side issue rather than a public-facing server, gateway, or internet-exposed service.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Dawn component of Google Chrome on Android, potentially allowing for arbitrary code execution outside the sandbox through a malicious HTML page. This issue carries a high severity rating due to its potential impact.

Code execution risk in Chrome on Android.
Requires user interaction to exploit.
Confirm relevance and scope.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into visiting a malicious webpage, which then exploits a flaw in a web browser component to execute code. This could allow the attacker to potentially gain control of the user's device.

Requires user interaction with a fake webpage.
Triggered by visiting a crafted HTML page.
Risk of arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could potentially execute arbitrary code outside the sandbox by convincing a user to visit a malicious HTML page. This is possible due to a buffer overflow vulnerability within the Dawn component of Google Chrome on Android. When successful, this could lead to a compromise of the user's device.

User's device data.
Visiting a malicious HTML page.
Arbitrary code execution outside sandbox.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affecting Chrome on Android requires a coordinated response. The first practical step is to confirm the presence and reachability of the affected Chrome version across your Android device fleet, identify the business criticality of devices where it's found, and then determine the accountable owner for remediation. This will allow for a risk-based approach to planning and executing the necessary updates.

Google Chrome on Android owner.
Verify affected Chrome versions.
Plan and coordinate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dawn component in Google Chrome on Android?

Dawn is a foundational library within the Chromium project used by Google Chrome. It serves as an implementation of WebGPU, which enables web applications to leverage the device's graphics hardware for high-performance tasks like 3D rendering and complex data processing.

What does the buffer overflow in CVE-2026-121247 mean?

This vulnerability, classified as CWE-122 (Heap-based Buffer Overflow), occurs when the Dawn component attempts to write more data into a memory buffer than it can hold. By overflowing this memory, an attacker can overwrite adjacent data, potentially allowing them to hijack the program's execution flow and run arbitrary code.

How is this buffer overflow triggered?

An attacker triggers this flaw by enticing a user to navigate to a specifically crafted HTML page. It is important to note that the vulnerability is not triggered by background processes or automated network connections; it strictly requires a user to actively visit a malicious website within the affected Chrome browser.

Is my organization at risk from this vulnerability?

According to Halo Surface Signal, this issue is rated as 'very unlikely' to pose a direct risk to your infrastructure. Because the flaw exists within a web browser client on Android rather than a public-facing server or gateway, it is a client-side concern that requires specific user action rather than an opportunistic scan of your internet-exposed services.

What should I do if I have devices running this version of Chrome?

Your first step is to inventory your Android fleet to identify which devices are running affected versions of Chrome. Once identified, coordinate with the accountable owners of those devices to prioritize and apply the necessary browser updates provided by Google to remediate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.