External risk intelligence

Chrome for Android Dawn Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-76036

This vulnerability is located in the client-side browser engine (Dawn) within Google Chrome on Android. It requires a user to navigate to a crafted HTML page, which is a client-side execution pattern. It is not an internet-facing service, gateway, or management portal, and therefore does not represent a public-facing network service.

Buffer Overflow

Google Chrome

before 151.0.7922.169

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Google Chrome on Android, specifically within the Dawn rendering engine. This flaw could allow a remote attacker to execute malicious code outside of the browser's secure environment by tricking a user into visiting a specially crafted webpage. The primary concern is to confirm if our organization utilizes this technology and could potentially be exposed.

Code flaws can let attackers run their programs.
Critical issue in widely used Android browser technology.
Verify our exposure to this specific browser vulnerability.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking a user into visiting a malicious webpage. This malicious page contains specially crafted code designed to trigger a buffer overflow in the Dawn component of Google Chrome on Android. Successful exploitation allows the attacker to execute arbitrary code, potentially compromising the device.

No privileges needed, requires user interaction.
Triggered by a crafted HTML page.
Arbitrary code execution outside sandbox.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow in Google Chrome's Dawn component on Android could allow a remote attacker to execute arbitrary code. This could occur when a user visits a specially crafted HTML page, potentially impacting the user's device when supported by the advisory.

Arbitrary code execution on user's device.
Visiting a malicious HTML page.
Compromise of user's device and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Chrome for Android's Dawn engine requires immediate attention from teams managing mobile endpoints and the application lifecycle. The first step is to identify all Android devices running the affected browser version, assess their exposure, and confirm the business criticality of those devices. Subsequently, pinpointing the accountable owner for these devices and planning remediation, potentially involving vendor coordination, will be necessary.

Mobile endpoint and app lifecycle owners.
Confirm device reachability and business criticality.
Plan coordinated remediation with vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dawn component in Google Chrome for Android?

Dawn is a graphics engine within the Chromium project, which powers Google Chrome on Android. It acts as an abstraction layer that helps the browser communicate with hardware to render complex web graphics and 3D content efficiently. When you browse interactive or media-heavy websites, components like Dawn are responsible for processing that data into the images you see on your screen.

What does this buffer overflow vulnerability mean?

This vulnerability is classified as a buffer overflow (CWE-122). It occurs when the Dawn engine receives more data than it can handle in a reserved area of memory, causing the excess information to overwrite adjacent memory. Because this happens in a way that escapes the browser's security sandbox, an attacker could potentially use this memory corruption to force the device to run unauthorized, malicious code.

How is this vulnerability triggered?

The flaw is triggered when a user visits a specifically crafted HTML page designed to exploit the buffer overflow in Dawn. It does not trigger simply by having the browser installed or running in the background. Navigating to standard, trusted websites does not activate the malicious code path required for this vulnerability.

Why should I care if I use Google Chrome on Android?

According to Halo Surface Signal, this is a client-side issue rather than an internet-facing network service. Because it requires a user to manually navigate to a malicious page, it is categorized as having a very low likelihood of automatic exploitation. You should care primarily because this is a browser-based risk that can affect any Android device using an unpatched version of Chrome.

Do I need to update my devices to address CVE-2026-76036?

Yes. The first step is to inventory all Android devices in your environment to identify which are running Chrome versions prior to 151.0.7922.169. Once identified, prioritize these devices for updates to the latest stable version provided by Google. Ensure that your mobile device management or application update policies are configured to push these security updates to endpoints as soon as they are available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.