CVE-2026-87520: Google Chrome Dawn Use After Free Vulnerability

CVE-2026-87520 Overview

CVE-2026-87520 is a use-after-free vulnerability in the Dawn component of Google Chrome on Android. Dawn is Chrome's implementation of the WebGPU standard, providing GPU acceleration to web content. Versions prior to 153.0.8010.36 are affected. A remote attacker can execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The bug is classified under CWE-416: Use After Free and carries a Chromium security severity of High.

Critical Impact
Successful exploitation results in arbitrary code execution outside the Chrome sandbox on Android devices, enabling attacker-controlled code to run with the privileges of the browser process.

Affected Products

Google Chrome for Android versions prior to 153.0.8010.36
Google Android devices running affected Chrome builds
Any Chromium-derived browser on Android bundling the vulnerable Dawn/WebGPU implementation

Discovery Timeline

2026-09-09 - CVE-2026-87520 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database
2026-09 - Google published the Stable Channel Update addressing the issue

Technical Details for CVE-2026-87520

Vulnerability Analysis

The flaw resides in Dawn, the cross-platform WebGPU implementation used by Chrome to expose GPU functionality to web pages through JavaScript. A use-after-free condition occurs when Dawn references a GPU resource or object after its backing memory has already been released. When the freed allocation is reused by attacker-controlled data, the dangling pointer can redirect control flow or corrupt structured state within the GPU process.

Because WebGPU is reachable directly from a web page, an attacker only needs the victim to load a malicious document. The NVD description explicitly states that exploitation allows code execution outside the sandbox, indicating the primitive escapes the renderer or GPU sandbox boundary rather than remaining confined to it. On Android, a sandbox escape from the browser process can expose device data and additional platform surface. See the Chromium Issue Tracker entry #529878021 for upstream tracking.

Root Cause

The root cause is object lifetime mismanagement inside Dawn. Chromium's WebGPU pipeline creates numerous transient objects tied to buffers, textures, command encoders, and pipeline states. When ownership or reference counting is handled incorrectly, an object can be destroyed while a caller still holds a raw pointer. Subsequent access to that pointer dereferences memory that may already be repurposed, satisfying the classic CWE-416 pattern.

Attack Vector

Exploitation is network-based and requires user interaction, typically loading a crafted HTML page. The attacker delivers JavaScript that issues WebGPU API calls to trigger the freed-object condition, then sprays the heap to control the reused allocation. Because the bug reportedly enables execution outside the sandbox, chained primitives inside Dawn are sufficient to break process isolation without a separate kernel exploit.

No public proof-of-concept exploit is currently listed for CVE-2026-87520, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available.
Refer to the Chromium Issue Tracker (#529878021) and the
Google Chrome Stable Channel Update advisory for technical details.

Detection Methods for CVE-2026-87520

Indicators of Compromise

Unexpected child processes spawned by the Chrome browser process on Android endpoints or Chromium-derived apps.
Crash reports referencing Dawn, WebGPU, or the GPU process shortly after visiting untrusted pages.
Outbound network connections initiated by Chrome to domains not associated with the user's browsing activity.

Detection Strategies

Inventory Chrome versions across managed Android fleets and flag any build earlier than 153.0.8010.36.
Alert on browser process anomalies such as memory region protection changes, JIT-adjacent execution, or unusual module loads within Chrome.
Correlate visits to newly registered or low-reputation domains with subsequent browser crashes or elevated GPU process activity.

Monitoring Recommendations

Ingest Android MDM and browser telemetry into a centralized analytics tier to track patch compliance for chrome package versions.
Monitor Chromium crash dumps and tombstone files on managed Android devices for stack frames referencing Dawn or WebGPU components.
Track web proxy logs for HTML responses containing WebGPU adapter or device requests originating from untrusted origins.

How to Mitigate CVE-2026-87520

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.36 or later on every managed device.
Push forced-update policies through enterprise mobility management to accelerate rollout beyond user-initiated updates.
Restrict access to untrusted web content from high-value Android endpoints until patch coverage is confirmed.

Patch Information

Google released the fix in the Chrome Stable Channel update documented at the Google Chrome Releases blog. Administrators should validate that Chrome for Android reports build 153.0.8010.36 or higher. Chromium-based browsers that embed Dawn should be updated once their vendors ship the upstream fix.

Workarounds

Disable WebGPU where feasible by configuring enterprise policy to turn off the WebGPU feature flag until patching completes.
Route Android browsing through a filtering proxy that blocks execution of unknown JavaScript on unclassified domains.
Segment users who cannot immediately update to restricted network zones with limited access to sensitive resources.

bash

# Example Android enterprise policy snippet to disable WebGPU
# Deploy via Managed Google Play / Android Enterprise configuration
{
  "WebGpuEnabled": false,
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"]
}