CVE-2026-76036: Google Chrome RCE Vulnerability

CVE-2026-76036 Overview

CVE-2026-76036 is a heap buffer overflow [CWE-122] in the Dawn graphics component of Google Chrome on Android. Versions prior to 151.0.7922.169 are affected. A remote attacker can execute arbitrary code outside the Chrome sandbox by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Critical.

Dawn is Chrome's WebGPU implementation, which exposes GPU functionality to web content. Because the flaw permits sandbox escape, successful exploitation grants the attacker code execution in the browser process context on the underlying Android device.

Critical Impact
Remote arbitrary code execution outside the Chrome sandbox on Android devices via a single crafted web page, requiring only that the user visit the attacker-controlled URL.

Affected Products

Google Chrome on Android prior to 151.0.7922.169
Google Chrome Dawn (WebGPU) component
Google Android devices running vulnerable Chrome builds

Discovery Timeline

2026-08-18 - CVE-2026-76036 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76036

Vulnerability Analysis

The vulnerability resides in Dawn, the cross-platform implementation of WebGPU used by Chrome to translate web-facing GPU commands into native graphics API calls. A heap buffer overflow in this component allows attacker-controlled data to write beyond an allocated buffer on the heap.

Because Dawn code paths handle content-supplied GPU resources and command buffers, an attacker can trigger the overflow directly from JavaScript running inside a rendered page. Successful exploitation corrupts adjacent heap memory, which an attacker can shape to hijack control flow and execute code outside the Chrome renderer sandbox.

The scope change reflected in the vulnerability's characteristics indicates that impact crosses the sandbox boundary. This is consistent with Dawn code executing in a privileged GPU process rather than the sandboxed renderer.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] in Dawn. Insufficient bounds checking on attacker-influenced sizes or offsets during WebGPU resource handling permits writes past the end of a heap allocation. Details of the specific function are tracked in Chromium issue 540087398.

Attack Vector

Exploitation is network-based and requires user interaction. The victim visits a crafted HTML page in a vulnerable Chrome for Android build. The page issues WebGPU calls that reach the vulnerable Dawn code path, triggering the overflow and enabling code execution outside the sandbox. See the Chromium Issue #540087398 tracker for developer-facing technical detail.

Detection Methods for CVE-2026-76036

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.169 after the patch release date
Unexpected child processes or native crashes originating from the Chrome GPU process on Android
Outbound connections from mobile endpoints to newly registered or low-reputation domains hosting WebGPU-heavy content

Detection Strategies

Inventory Chrome versions across managed Android fleets and flag any build below 151.0.7922.169
Monitor mobile device management (MDM) telemetry for Chrome crash reports referencing Dawn or GPU process faults
Correlate browsing telemetry with threat intelligence on domains serving malicious WebGPU payloads

Monitoring Recommendations

Enable Chrome enterprise reporting to surface version drift and crash events centrally
Alert on post-browse behavioral anomalies such as unexpected process spawns or privilege changes on Android endpoints
Track Google's Chrome Releases blog for follow-up advisories and regressions

How to Mitigate CVE-2026-76036

Immediate Actions Required

Update Chrome for Android to 151.0.7922.169 or later on all managed and BYOD devices
Push the update through MDM or Google Play managed distribution to enforce compliance
Restart Chrome after update to ensure the vulnerable process is no longer resident

Patch Information

Google released the fix in Chrome for Android version 151.0.7922.169. Refer to the Google Chrome Stable Update advisory for the full changelog and associated Chromium bug references, including Chromium Issue #540087398.

Workarounds

Disable WebGPU via enterprise policy where a browser update cannot be applied immediately
Restrict browsing on unpatched Android devices to trusted internal sites using MDM URL filtering
Use network-level filtering to block known malicious domains delivering WebGPU exploit content

bash

# Chrome enterprise policy example to disable WebGPU on Android via MDM managed configuration
# Deploy the following JSON payload as Chrome managed configuration
{
  "URLBlocklist": {
    "value": ["*"]
  },
  "URLAllowlist": {
    "value": ["https://*.corp.example.com"]
  }
}